> ## Documentation Index
> Fetch the complete documentation index at: https://dev.kernel.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

Authenticate requests to the Kernel API using API keys passed in the `x-api-key` header.

## Authentication

Every request must include an API key:

```bash curl theme={null}
curl https://api.kernel.ai/rest/v1/entity-resolution \
  -H "x-api-key: $KERNEL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"legal_name": "Stripe"}'
```

Requests without a valid key receive a `403 Forbidden` response with body `{ "message": "Forbidden" }`.

## Creating an API key

1. Go to **Settings > API keys** in the [Kernel app](https://app.kernel.ai)
2. Click **Create key** and optionally give it a name
3. Copy the key value and signing secret — both are shown only once

<Tip>
  Store your API key in an environment variable and never commit it to source control.

  ```bash theme={null}
  export KERNEL_API_KEY="ker_your_api_key_here"
  ```
</Tip>

## Key value

The key value is a string you pass in the `x-api-key` header. After creation, the full key is displayed once — it cannot be retrieved later. If you lose a key, delete it and create a new one.

## Webhook signing secret

Each API key comes with a webhook signing secret (prefixed with `whsec_`). Use this secret to verify that webhook payloads were sent by Kernel. See [Webhooks](/api-reference/endpoint/webhooks) for the verification process.

The signing secret is shown once when you create an API key. If you need a new secret, delete the key and create a new one.

## Deleting a key

Deleting an API key immediately revokes it. Any requests using that key will receive a `401 Unauthorized` response.

To delete a key, go to **Settings > API keys**, open the key's menu, and select **Delete key**.

## Security best practices

* Store API keys in environment variables, never in source code
* Use separate keys for development and production
* Rotate keys if you suspect they have been leaked
* Delete keys you no longer need