> For the complete documentation index, see [llms.txt](https://sm-fund.gitbook.io/sm-fund-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sm-fund.gitbook.io/sm-fund-docs/get-started/api-keys.md).

# API Keys

Manage API Keys in your [dashboard](https://sm.fund/dashboard/). A key authenticates requests to the [Ticket endpoint](/sm-fund-docs/reference/tickets.md); use the returned Ticket for the WebSocket handshake.

## Create and store a key

Open **API Keys**, choose **Create API Key**, and give it a name that identifies the client. Copy the full key when it is displayed. Later, the dashboard shows only its identifying prefix and metadata.

Store keys in environment variables or a secret manager. Keep them out of source control, browser bundles, URLs, screenshots, and logs. Anyone with an active key can request connection Tickets for your account.

## Limits and rotation

Each user can have **two active, unexpired keys**. Expired and revoked keys remain in history but do not use this allowance. Extra keys do not add connection capacity: all keys share one connection per user.

To rotate a key:

1. Create a replacement key while the old key is still active.
2. Update your client, request a fresh Ticket, and connect with the replacement. This replaces the old connection.
3. Revoke the old key after confirming that the replacement receives data.

If both slots are occupied, revoke a key you no longer use before creating another. Make sure the old client stops on close code `4001` before starting the replacement.

## Revoke a key

Revocation disables future use of that key and invalidates its outstanding Tickets. An active connection using it closes with `4003 access revoked`. A revoked key cannot be recovered or made active again; create a new one when needed.

Changing or canceling your subscription does not require creating another API Key. See [plans and billing](/sm-fund-docs/get-started/plans-and-billing.md) for when access changes.