# Manage Your API Key

> Safely reveal, copy, store, use, and regenerate the OptionData API key shared by the realtime and HTTP data APIs.

Your OptionData API key authenticates Realtime WebSocket, Historical SQL, Option Chain, and Market Structure requests.

## View and copy the key

1. Sign in and open [API Key](/api_key).
2. Select the eye control only when you need to inspect the full key.
3. Select **Copy** to copy the current value.

The portal normally issues an `apikey_...` token. Treat it like a password.

![Annotated OptionData API Key page showing the masked key, Copy action, and Regenerate Key action](/docs/manage-api-key/api-key-page-annotated.png)

*Copy the masked portal key when you need to configure a client; regenerate only when you are ready to update every consumer.*

## Store it safely

Keep the key in a secret manager or local environment variable:

```bash
export OPTIONDATA_API_KEY="YOUR_API_KEY"
```

Do not place a real key in:

- Git-tracked `.env` files
- screenshots, support tickets, or chat messages
- browser URLs that you log or publish
- frontend bundles or public repositories

For HTTP APIs, send the key with the canonical bearer header:

```http
Authorization: Bearer YOUR_API_KEY
```

Realtime WebSocket authentication uses the `token` query parameter. Redact the complete WebSocket URL from application logs because it contains the key.

## Regenerate the key

Use **Regenerate Key** only when the current key may be exposed or you intentionally want to rotate it.

Regeneration invalidates the previous portal key immediately. Update every service, environment, and scheduled job that uses it before considering rotation complete.

A safe rotation sequence is:

1. Inventory every consumer of the current key.
2. Regenerate the key in [API Key](/api_key).
3. Update secret stores and deployment environments.
4. Restart or redeploy consumers.
5. Verify one HTTP request and one WebSocket handshake.

## Verify the key without exposing it

Use a small authenticated request, such as the [Market Structure Quickstart](/docs/market-structure-quickstart). Do not paste the full key into a support message. If support needs to identify it, provide only the account email and the final four characters.

See [Troubleshoot Authentication and Access](/docs/troubleshoot-api-access) for `401`, `403`, and `429` responses.