# Your API key

Your API key works like a password: it lets your AI agent or your software use APIs on your account, and every call is billed to you. One key works for every API on Zyla API Hub, the Zyla MCP server and the Listings API.

If you use an AI agent you rarely touch it: the setup line in [Connect AI agents (MCP)](https://zylalabs.com/docs/mcp) already includes it.

## Get your key

1. [Sign up](https://zylalabs.com/register) or [log in](https://zylalabs.com/login).
2. Open [Connect AI agents (MCP)](https://zylalabs.com/docs/mcp). Your key is shown in **Your API Access Key**, with a **Copy** button. All your keys are also in **API keys**, in the account menu.

## Use it in your code

Developers send it in the `Authorization` header of every request:

```http
Authorization: Bearer YOUR_API_KEY
```

## Create more keys

Open **API keys** from the account menu ([/api_keys](https://zylalabs.com/api_keys)) to:

- create additional keys with a name, for example one per project or environment;
- limit a key to specific APIs, so a leaked key cannot be used against the rest of your subscriptions;
- revoke a key at any time. Requests made with a revoked key get `401`.

A key limited to some APIs gets `403` when it calls an API outside its list.

## Keep it secret

- Do not put the key in client-side code (browser JavaScript, mobile apps). Call Zyla from your backend.
- Do not commit it to a repository. Load it from an environment variable or a secrets manager.
- If a key leaks, revoke it in **API keys** and create a new one.


---
Source: https://zylalabs.com/docs/api-keys