API keys let your application authenticate to Multifactor on the server side.

Each agent has its own API key. Create an agent and you'll get a key you can use for server-to-server requests; you can rotate or revoke it anytime from the agent's page. See Create and manage agents.

A dedicated API keys area for managing keys in one place is on the way. You'll see it in the developer dashboard marked Coming soon.

Tip: Keep API keys secret — store them in your server's environment or a secrets manager, never in client-side code or a public repository. If a key is ever exposed, rotate it from the agent's page right away.