> For the complete documentation index, see [llms.txt](https://docs.trezalabs.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.trezalabs.com/api/api-keys.md).

# API Keys

Treza API keys authenticate programmatic access to the platform: calling a published [pipeline](/pipelines/pipelines.md) and using the [AI Gateway](/ai-gateway/ai-control-plane.md). A key looks like `treza_live_...`, is scoped to your account, and is sent as a bearer token.

***

## Create a key

In the dashboard, open the **API keys** page and create a key.

{% hint style="warning" %}
The key (`treza_live_...`) is shown **once**, at creation. Store it in a secrets manager immediately. If you lose it, revoke it and create a new one.
{% endhint %}

***

## Use a key

Send the key in the `Authorization` header as a bearer token on every request:

```
Authorization: Bearer treza_live_...
```

For example, invoking a published pipeline:

```bash
curl https://trezalabs.com/api/pipelines/<id>/invoke \
  -H "Authorization: Bearer treza_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "inputs": { "brief": "A 6-second product demo" } }'
```

The same key works with the OpenAI-compatible endpoint. Point any OpenAI SDK at your pipeline and pass the key as the `api_key`. See the [Pipeline API](/api/pipeline-api.md).

***

## Ownership and scope

* **Account-scoped.** A key can only act on resources owned by the same account. In particular, a key can only invoke pipelines your account owns; calls to another account's pipeline return `403`.
* **Published only.** Pipeline endpoints serve the published snapshot. An unpublished pipeline returns `409`.
* **Credits.** Calls that run a pipeline draw from your account's prepaid credit balance. If the balance is empty, requests return `402`.

***

## Scopes

Keys carry scoped permissions that gate access per feature. Grant only the scopes a key needs.

| Scope                                                                           | Grants                                                                                           |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| `redact:proxy`                                                                  | OpenAI-compatible redacting chat completions (the [AI Gateway](/ai-gateway/ai-control-plane.md)) |
| `redact:run`                                                                    | Standalone text redaction                                                                        |
| `redact:log`                                                                    | Read the redaction audit log                                                                     |
| `pii:ingest`, `pii:read`, `pii:write`, `pii:delete`, `pii:consent`, `pii:audit` | PII vault operations                                                                             |

Invoking a published pipeline requires a valid key that owns the pipeline; the gateway and PII endpoints additionally require the scopes above.

***

## Manage and rotate

* **Revoke** a key from the API keys page the moment you suspect it is exposed.
* **Rotate** keys periodically: create a new key, move your integrations over, then delete the old one.
* **Never** embed a key in client-side code or a public repository. Call Treza from your backend, where the key stays secret.

***

## Related

* [Pipeline API](/api/pipeline-api.md) - call a published pipeline with your key.
* [Build your first pipeline](/pipelines/quickstart.md) - end-to-end, including creating a key.
* [AI Gateway](/ai-gateway/ai-control-plane.md) - redaction proxy that uses `redact:*` scopes.