> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fincept.in/llms.txt
> Use this file to discover all available pages before exploring further.
# API Keys
> Complete guide to API key types, management, and lifecycle
# API Keys
API keys are your credentials for accessing Fincept API. This guide covers key types, obtaining keys, managing them, and security practices.
## Key Types
### Registered User Keys
Permanent keys for full API access.
**Format:** `fk_user_` + 43-character random string
**Example:** `fk_user_Hy8kL2mN9pQ1rS3tU4vW5xY6zA7bC8dE9fG0hI1jK2lM3nO4pQ5rS6tU7vW8xY9z`
**Features:**
| Feature | Available |
| ----------------- | ------------------------- |
| Validity | Permanent (never expires) |
| Credit Management | Full access |
| Tier Access | Based on subscription |
| Usage Analytics | Complete history |
| MFA Support | Yes |
| Key Regeneration | Anytime |
### Guest Keys
Temporary 24-hour keys for testing.
**Format:** `fk_guest_` + 43-character random string
**Example:** `fk_guest_Aa1bB2cC3dD4eE5fF6gG7hH8iI9jJ0kK1lL2mM3nN4oO5pP6qQ7rR8sS9tT0uU1v`
**Features:**
| Feature | Available |
| ----------------- | ---------------------- |
| Validity | 24 hours |
| Credit Management | 50 credits (no top-up) |
| Tier Access | Free tier only |
| Usage Analytics | Limited |
| MFA Support | No |
| Key Regeneration | No |
## Obtaining API Keys
### Get Registered User Key
**Step 1: Register**
```bash theme={null}
curl -X POST https://api.fincept.in/user/register \
-H "Content-Type: application/json" \
-d '{
"username": "johndoe",
"email": "john@example.com",
"password": "SecurePass123!"
}'
```
**Step 2: Verify Email (OTP)**
```bash theme={null}
curl -X POST https://api.fincept.in/user/verify-otp \
-H "Content-Type: application/json" \
-d '{
"email": "john@example.com",
"otp": "123456"
}'
```
**Response includes your API key:**
```json theme={null}
{
"success": true,
"data": {
"api_key": "fk_user_your_permanent_key",
"message": "Account verified successfully"
}
}
```
**Save this key immediately!** Store it in a password manager or environment variable. It's only shown once.
### Get Guest Key
No email required - instant access:
```bash theme={null}
curl -X POST https://api.fincept.in/guest/create \
-H "Content-Type: application/json" \
-d '{
"device_id": "laptop-chrome-001",
"device_name": "Development Laptop",
"platform": "macos"
}'
```
**Response:**
```json theme={null}
{
"success": true,
"data": {
"api_key": "fk_guest_temporary_key",
"credit_balance": 50,
"expires_at": "2024-01-16T10:30:00Z"
}
}
```
## Using Your API Key
### Authentication Header
Include in every request:
```bash theme={null}
curl https://api.fincept.in/user/profile \
-H "X-API-Key: fk_user_your_key_here"
```
### Environment Variables
**Linux/macOS:**
```bash theme={null}
export FINCEPT_API_KEY="fk_user_your_key"
curl https://api.fincept.in/user/profile \
-H "X-API-Key: $FINCEPT_API_KEY"
```
**Windows CMD:**
```cmd theme={null}
set FINCEPT_API_KEY=fk_user_your_key
curl https://api.fincept.in/user/profile ^
-H "X-API-Key: %FINCEPT_API_KEY%"
```
**Windows PowerShell:**
```powershell theme={null}
$env:FINCEPT_API_KEY="fk_user_your_key"
curl https://api.fincept.in/user/profile `
-H "X-API-Key: $env:FINCEPT_API_KEY"
```
### In Code
**Python:**
```python theme={null}
import os
import requests
API_KEY = os.getenv("FINCEPT_API_KEY")
headers = {"X-API-Key": API_KEY}
response = requests.get(
"https://api.fincept.in/user/profile",
headers=headers
)
```
**JavaScript/Node.js:**
```javascript theme={null}
const API_KEY = process.env.FINCEPT_API_KEY;
const response = await fetch(
"https://api.fincept.in/user/profile",
{
headers: { "X-API-Key": API_KEY }
}
);
```
## Managing Your API Key
### Retrieve Existing Key
Login to get your current API key:
```bash theme={null}
curl -X POST https://api.fincept.in/user/login \
-H "Content-Type: application/json" \
-d '{
"email": "john@example.com",
"password": "SecurePass123!"
}'
```
**Response:**
```json theme={null}
{
"success": true,
"data": {
"api_key": "fk_user_your_existing_key",
"message": "Login successful"
}
}
```
### Regenerate API Key
If compromised, regenerate immediately:
```bash theme={null}
curl -X POST https://api.fincept.in/user/regenerate-api-key \
-H "X-API-Key: fk_user_old_key"
```
**Response:**
```json theme={null}
{
"success": true,
"data": {
"api_key": "fk_user_new_key",
"message": "API key regenerated successfully"
}
}
```
**Old key stops working immediately!** Update all applications before regenerating.
### View Key Info
Check when your key was created:
```bash theme={null}
curl https://api.fincept.in/user/profile \
-H "X-API-Key: fk_user_your_key"
```
**Response includes:**
```json theme={null}
{
"api_key_created_at": "2024-01-15T10:30:00Z",
"api_key_status": "active"
}
```
## Key Lifecycle
### Registered User Keys
```mermaid theme={null}
graph LR
A[Register] --> B[Verify Email]
B --> C[Key Generated]
C --> D[Active Forever]
D --> E[Regenerate if needed]
E --> D
D --> F[Delete Account]
```
**States:**
* `active` - Key is valid and usable
* `suspended` - Temporarily disabled (admin action)
* `revoked` - Permanently disabled after regeneration
### Guest Keys
```mermaid theme={null}
graph LR
A[Create Guest] --> B[Key Generated]
B --> C[Active for 24h]
C --> D[Expired]
D --> E[Deleted]
```
**Auto-cleanup:** Expired guest keys are automatically deleted after 7 days.
## Security Features
### Key Validation
Every request validates:
1. Key format matches `fk_user_*` or `fk_guest_*`
2. Key exists in database
3. Key status is `active`
4. User account is verified
5. Key hasn't expired (for guests)
### Rate Limiting
API keys are rate-limited to prevent abuse:
| Account Type | Limit |
| ------------ | --------------- |
| Guest | 60/hour, 50/day |
| Free | 500/hour |
| Basic | 1,000/hour |
| Standard | 2,000/hour |
| Pro | 5,000/hour |
### IP Tracking
All key usage is logged with IP address for security auditing.
## Troubleshooting
### Invalid API Key Error
```json theme={null}
{
"success": false,
"message": "Invalid or expired API key"
}
```
**Solutions:**
* Check key was copied correctly (no spaces)
* Verify key hasn't been regenerated
* For guests, check expiry time
* Login to retrieve current key
### Key Not Working After Regeneration
**Cause:** Old key cached in application
**Solution:** Clear environment variables and restart application
### Guest Key Expired
```json theme={null}
{
"success": false,
"message": "Guest API key has expired"
}
```
**Solutions:**
* Create new guest account (another 24 hours)
* Register for permanent account (350 free credits)
## Best Practices
* Use environment variables
* Never commit to git
* Use password managers
* Encrypt in production configs
* Regenerate every 90 days
* Immediately if compromised
* Track creation dates
* Different keys for dev/staging/prod
* Separate accounts for team members
* Use guest keys for local testing
* Check login history regularly
* Review API usage patterns
* Set up alerts for unusual activity
* Add extra security layer
* Protect high-value accounts
* Required for enterprise
## Next Steps
Enable multi-factor authentication
Learn security best practices
Make your first API call
Complete authentication documentation