# Developer keys

API keys let your organisation's backend call the Wandura Delivery API. Members with the **developer** or **admin** role create, rotate and revoke keys themselves on the **Developers** screen of the partner portal. This page covers the portal side; for how to send a key with each request, see [Authentication](https://docs.wandura.ai/developers/authentication).

## Open the Developers screen

- **Developers** sign in straight to this screen; it is the only screen they have.
- **Admins** find it under **Setup** → **Developers** in the sidebar.

If you need this screen and do not see it, ask an admin of your organisation to give you the developer role. See [Team and organisation](https://docs.wandura.ai/partners/team).

## Scopes

Each key carries one or more scopes. A key can only call the endpoints its scopes allow.

| Scope | Shown in the portal as | Who creates it |
|---|---|---|
| `metadata:read` | Read film metadata | You, in the portal |
| `creatives:export` | Receive exported creatives | You, in the portal |
| `webhooks:manage` | Manage webhooks | You, in the portal |
| `playback` | Play films | You, in the portal |

To stream films in your app, pick **Stream films in an app** when you create the key. It gets `metadata:read` and `playback`.

> **Warning:** If a playback key leaks, anyone can stream your licensed films. Revoke it immediately. The portal shows this warning on the card and again next to the new key. Every new playback key, and every rotation of one, also sends an alert to Wandura with your organisation, who created it and its prefix (never the key itself).

The [API reference](https://docs.wandura.ai/developers/reference/overview) lists which endpoint needs which scope.

## Create a key

1. Open **Developers**.
2. Under **Create a key**, enter a **Label** that says where the key is used, for example `cms-prod`. Up to 80 characters.
3. Tick at least one scope. **Read film metadata** is ticked by default.
4. Press **Create key**.
5. Copy the key from the box that appears, using **Copy key**, and store it in your secrets manager.
6. Press **I saved it** to close the box.

> **Warning:** The full key is shown only once. Wandura cannot show it again. If you lose it, rotate the key or create a new one.

Keep keys on your servers only. Never put a key in a browser page, a mobile app or a public repository.

## The key list

The **Keys** list shows every key of your organisation, newest first. For each key you see:

- The first characters of the key followed by `…`, and its label.
- Its scopes.
- Its status: **Never used**, **Last used** *date and time*, or **Revoked**.

## Rotate a key

Rotating replaces a key's secret and keeps its label and scopes.

1. Press **Rotate** on the key.
2. Confirm with **Rotate key**. The current key stops working immediately.
3. Copy the new key from the box that appears. As with a new key, it is shown only once.

Update your servers right after rotating, because requests made with the old key fail from that moment. You cannot rotate a revoked key. Playback keys rotate like any other key; to switch without downtime, create a second playback key, deploy it, then revoke the old one.

## Revoke a key

1. Press **Revoke** on the key.
2. Confirm with **Revoke key**.

Anything using the key stops working immediately, and revoking cannot be undone. The key stays in the list marked **Revoked**.

| Key type | Developer | Admin |
|---|---|---|
| Any key of your organisation, playback keys included | Rotate, revoke | Rotate, revoke |

> **Warning:** Revoking a playback key stops film playback in your apps immediately. If you think the key has leaked, revoke it anyway, then create a new playback key for your servers.

## Next steps

- [Authentication](https://docs.wandura.ai/developers/authentication)
- [API reference](https://docs.wandura.ai/developers/reference/overview)