# Authentication
Source: https://nordvec.com/docs/guides/authentication#creating-a-key

## Creating a key [#creating-a-key]

Create a key under **Settings > API Keys**. Creating one needs the workspace
**owner** or **admin** role; on a personal workspace that is you. The **raw key
is returned exactly once** and is never retrievable afterwards, so copy it into
your secret store straight away.

A key belongs to the workspace, not to the person who created it. It reads
what the workspace shares: documents a person has connected but not shared stay
visible only to that person, and no key can see them. A key does stop working
once the person who created it, or last rotated it, leaves the workspace, so a
departing admin's keys do not outlive their access; an owner or admin who
rotates the key takes it over, and it works again.

A key's lifetime is 1 to 365 days, and a key created without one works for 365
days. Rotating a key starts its lifetime again from the day of the rotation.
A key can also carry an IP allowlist of up to 50 addresses or CIDR ranges.

A key no request authenticates with for 45 days, counted in UTC calendar days,
is disabled. After 38 days of disuse, the workspace's owners and admins get a
notice naming the key and the date it will be disabled; one request the key
authenticates before that date keeps it, and so does rotating it. A key that
expires before that date stops working at its expiry instead, and gets no notice
unless it has already gone 45 days unused. With no owner or
admin left to notify, the key is disabled at 45 days without a notice. A
request the key's IP allowlist refuses, or one refused because the key's creator
has left, is not authenticated and does not count. A disabled key never works
again, so create a new key for any application that still needs one.