> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bridge.linkio.world/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API keys

> Create keys, choose what each key can do, and keep them safe.

An API key is required on every request so we know the request comes from your business.

## Create a key

**1. Open API keys**

In the Bridge app, go to **API keys** and choose **Generate API Key**.

**2. Name it**

Give it a name that says where it's used, for example `Production API`.

**3. Choose how long it lasts**

Pick 1, 7, 30, 90, 180, or 365 days. The key stops working after that.

**4. Choose what it can do**

Pick its scopes (see below). Only give a key what it needs.

**5. Copy and save the key**

Your new key is shown **only once**, right after you create it. Copy it straight away and save it somewhere safe, such as your server's secret manager. Once you leave this screen, the full key can't be shown again. If you lose it, revoke it and create a new one.

## Sandbox and live keys

| Key starts with | Works with |
| - | - |
| `bridge_sbx_` | `https://sandbox.core.linkio.world/api` only |
| `bridge_live_` | `https://core.linkio.world/api` only |

Create sandbox keys in the sandbox Bridge app and live keys in the live Bridge app.

## Scopes: what a key can do

Each scope can allow **read** (look things up) and **write** (create or change things).

| Scope group in the Bridge app | What it allows |
| - | - |
| **Ramps, banks & methods** | Create onramps and offramps, submit mobile money codes, list and view payments, look up banks, mobile money networks, and payment methods. |
| **Quotes** | Get and refresh quotes. |
| **Customers** | Add, list, and view customers. |

If a key calls an endpoint it isn't allowed to use, the request fails with `403` and the message `This API key does not have access to this resource.`

## Use the key

Send the key in the `X-BRIDGE-API-Key` header of every request:

```bash theme={null}
curl https://sandbox.core.linkio.world/api/customers/list \
  -H "X-BRIDGE-API-Key: bridge_sbx_your_key_here" \
  -H "API-Version: 2026-10-29-atlas"
```

> [!WARNING]
>
> Never put your API key in a mobile app, a website, or a public code repository. Only call Bridge from your own server.

## Update or revoke a key

Open the key in **API keys** to see when it was last used, change its scopes, or revoke it. A revoked key stops working straight away.

If you think a key has leaked, revoke it and create a new one.

## Key errors

These all return `401`:

| Message | What it means |
| - | - |
| `Missing X-BRIDGE-API-Key header.` | You didn't send a key. |
| `Unrecognized API key. Use a bridge_sbx_ key.` | The key isn't a Bridge key. |
| `This is a sandbox API key. Send it to the sandbox API.` | You sent a sandbox key to live. |
| `This is a live API key. Send it to the live API.` | You sent a live key to the sandbox. |
| `Your Business account has been suspended. Please contact support.` | Your business has been suspended. |
| `Account doesn't exist. Please contact support.` | Your business isn't onboarded or your account was shutdown indefinitely. |

An expired or revoked key is also rejected with `401`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.