> ## Documentation Index
> Fetch the complete documentation index at: https://docs.defindex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Your API Key

Before integrating with the DeFindex API you need an API key. You create it yourself in the DeFindex Console: no invitation, no waiting list, no approval step.

***

## Step 1: Open the Console

👉 [https://console.defindex.io/](https://console.defindex.io/)

Create your account with an email and a password, or log in if you already have one.

***

## Step 2: Generate the Key

In the console, open the **API Keys** section and click **Generate API Key**.

The key looks like `sk_1234567890abcdef...`, and it is the only credential your backend needs. Copy it when it is shown.

> **You hold one active API key at a time.** Generating a new key revokes the previous one immediately, so any service still sending the old value starts receiving `403`. There is no overlap window: roll the new key out as soon as you generate it.

> **Keep it secret.** The key carries your account's permissions. Store it in an environment variable, never commit it, and never ship it in client-side code.

***

## Step 3: Use the API Key in Requests

Include the key as a Bearer token in the `Authorization` header:

```http theme={null}
Authorization: Bearer <your_api_key>
```

TypeScript example:

```typescript theme={null}
const response = await fetch(`https://api.defindex.io/vault/${vaultAddress}/deposit`, {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'Authorization': `Bearer ${process.env.DEFINDEX_API_KEY}`
    },
    body: JSON.stringify(params)
});
```

You can check the API is reachable before you even register: `GET /health` and `GET /vault/discover?network=mainnet` need no key. Everything else returns `403` without a valid one.

***

## Key Lifetime and Rotation

**The API key does not expire on a timer.** It stays valid until it is revoked, and there are only two ways that happens:

* You generate a new key, which revokes the previous one.
* You revoke it explicitly from the **API Keys** section of the console.

If requests that used to work start returning `403 Forbidden resource`, the key was replaced or revoked, not expired. Check the current value in the console.

> **`refresh_token` is unrelated to your API key.** `/login` and `/refresh` issue short-lived JWT *access tokens*, which is how the console authenticates its own session. If you authenticate with an API key, you never call `/refresh`.

***

## Next Steps

* [Getting Started with the API](/integration-guide/api)
* [Beginner Guide — Vault Deposit Example](/integration-guide/guides-and-tutorials/beginner-guide)
* [Full API Reference](https://api.defindex.io/docs)

***

## Need Help?

If you run into issues, join our [Discord](https://discord.gg/aV5jHwmsaj) and ask in the developer channel.