# Authorization

Cryptonly API requests must be authorized with an API key. Send the key from your backend.

## Who can manage API keys?

Only **organization administrators** can manage API keys.

Organization administrators can:

* create API keys
* edit a key's name and scopes
* delete API keys
* view existing API keys

If you do not see API key management options, your account may not have administrator permissions.

## Where to manage API keys

API keys belong to an account. They are managed in the Cryptonly admin application under **Accounts → Settings → Security**.

To manage API keys:

1. Open the admin app.
2. Go to **Accounts** and select the account.
3. Open the **Settings** tab, then **Security**.
4. Use the **API Keys** section.

A key acts as that account. Requests authenticated with it operate on the account it was created for.

In this section, you can:

* view existing keys (name and scopes; the secret is not shown again)
* create a new key — set a name and at least one scope, then copy the secret immediately
* edit a key's name and scopes
* delete a key

The secret is shown only once, when the key is created.

The **Webhook signing key** for verifying `invoice.statusChanged`, `deposit.statusChanged`, and `withdrawal.statusChanged` payloads is on the same **Security** page, under **API Keys**. It is also per account. The page shows a fingerprint. **Rotate key** replaces the current key immediately and shows the new secret once. Only organization administrators can view the fingerprint or rotate the key.

## How to use an API key

Include your API key in the x-tenant-api-key header of each API request.

```
x-tenant-api-key: YOUR_API_KEY
```

All authenticated requests must be sent over HTTPS.

## Deleting a key

If an API key is no longer needed, or if you suspect it has been compromised, delete it from the account's **Security** page.

Once deleted, the key can no longer be used to authorize API requests.

## Related pages

- [Webhooks](https://docs.cryptonly.net/api-reference/webhooks.md): The signing key is on the same Security page
- [HTTP status codes](https://docs.cryptonly.net/api-reference/http-status-codes.md): 401 and 403 when a key is missing or not allowed
- [Idempotency](https://docs.cryptonly.net/api-reference/idempotency.md): Retry create requests with the same orderId
- [API reference](https://docs.cryptonly.net/api-reference.md): What an API key can call