# Generate an API key (/core/embed/authentication/how-to/generate-an-api-key)





<CalloutContainer type="info">
  <CalloutDescription>
    **Target Audience**: Developers & Non technical users
  </CalloutDescription>
</CalloutContainer>

### Goal [#goal]

Obtain an API key to securely authenticate server-side requests to Toucan AI.

***

### Prerequisites [#prerequisites]

* A [Toucan AI account](/core/getting-started/quick-start/subscribe-to-toucan) with active access.
* Permissions to modify user profile and security settings.

***

### Steps [#steps]

#### 1. Open security settings [#1-open-security-settings]

* Locate the user profile icon (containing your initials) in the bottom-left corner of the Toucan AI interface.
* Click the icon and select the **Account settings** from the navigation menu.

#### 2. Navigate to API keys [#2-navigate-to-api-keys]

* Scroll to the **API Keys** section.
* This area displays existing keys and allows for the creation of new credentials.

#### 3. Generate the key [#3-generate-the-key]

* Click the **Create API Key** button.
* Toucan AI will generate and display a new unique string.

#### 4. Secure the credential [#4-secure-the-credential]

* Copy the key immediately and save it in a secure environment, such as a password manager or your application’s environment variables (`.env`).

<CalloutContainer type="error">
  <CalloutDescription>
    **Security Alert**: Never expose this key in client-side code, public repositories, or frontend scripts, as it grants administrative access to generate session tokens.
  </CalloutDescription>
</CalloutContainer>

<img alt="API Keys" src="__img0" />

***

#### API key functionality [#api-key-functionality]

The API key acts as a master credential for the following backend operations:

* **Token Generation**: Requesting signed session tokens for embedded dashboards and the AI assistant.
* **Access Control**: Defining user permissions and roles within the generated tokens.
* **Data Filtering**: Passing attributes for Row-Level Security (RLS) enforcement.

***

### Conclusion [#conclusion]

The API key is now active and stored for backend use. This credential serves as the foundation for authenticating your users and delivering personalized analytics experiences.

**Suggested Next Step**: [How-to: Generate a token](/core/embed/authentication/how-to/authentication-and-tokens)