# Authentication and key safety

> Create, store, rotate, and recover sandbox API credentials without losing tenant data.

Human-readable version: https://agsemble.com/docs/api/authentication

## Bearer authentication

API keys are shown once and stored only as hashes by Agsemble. Do not embed a production key in a mobile application or source repository.

```http
Authorization: Bearer ag_test_...
```

## Recovery kit

A new sandbox returns api_key_id and recovery_code alongside the key. A successful recovery replaces both secrets while preserving fields, observations, usage, and billing identity.

## Rotate an exposed key

```ts
const replacement = await agsemble.apiKeys.rotate();
// Save replacement.api_key before continuing.
```