> For the complete documentation index, see [llms.txt](https://docs.jetpero.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.jetpero.com/features/api-key-management.md).

# API Key Management

### 🚀 Add a New API Key

Each project in JetPero can have one or more **provider integrations**. Here's how to add them:

#### 🔧 Steps:

1. Choose the relevant project (e.g., `abc.co`)
2. Go to **Admin Planel → Under API providers table**
3. Click **“Add new API”**
4. Fill in the details:
   * **Base URL** (e.g., `https://api.openai.com/v1`)
   * **Provider Name** (e.g., `openai`)
   * **API Key** (your real provider key)

✅ JetPero will auto-configure this for secure usage under your selected project.

***

### 🔐 Project-Based Key Isolation

Every **Project** under your **Organization** has:

* Its own **Auth Token** (JWT / crypto-based)
* Independent set of **provider API keys**
* **Isolated traffic and rate limits**
* Fine-grained security (great for agencies, dev teams, multi-client products)

> Example:\
> If you have two clients — `abc.co` and `tt.net` — each gets separate setup and tokens. Keys from one project **can’t leak** into the other.

***

### 🧠 How JetPero Handles Your Keys

* 🧩 You **store** your provider’s real API key once during setup
* 🧠 JetPero **injects** it securely behind the scenes during each request
* 🔐 Your frontends or external apps **never touch the provider API key**
* 🔁 You only use the JetPero-generated **Project Token** in your requests

```bash
Authorization: Bearer <Your-Project-Token>
```

### 🔄 Update / Rotate / Delete Keys

* Go to **Project Settings → Providers**
* Select the provider (e.g., `openai`)
* Choose:
  * 🔄 **Rotate API Key**
  * 📝 **Edit Base URL**
  * ❌ **Remove Provider**

> ⚠️ All changes are **instant** and **audited**. We’ll never expose deleted keys.

### 🛡️ Security Features

* 🔐 Encrypted storage of provider keys (AES-256)
* ✅ JWT-based project tokens
* 🧍 Role-based access (Admin-only by default)
* 📊 Access logs for every key interaction
* 🚫 Automatic request blocking if token or key is invalid

***

### 🎯 Best Practices

* Use short, clear **provider names** (`openai`, `huggingface`, `elevenlabs`)
* Create a separate **project per product/client**
* Rotate keys regularly if providers support it
* Never share your actual provider API key — just the JetPero token!

***

### 🔍 Coming Soon

* 📁 Multi-env support (prod / dev / staging keys)
* 🔐 Expiry dates and alerts for keys
* 🔁 Versioned API key backups