# Developer keys

API keys let your organisation's backend call the Wandura Delivery API. Members with the **developer** or **admin** role create, rotate and revoke keys themselves on the **Developers** screen of the partner portal. This page covers the portal side; for how to send a key with each request, see [Authentication](https://docs.wandura.ai/developers/authentication).

## Open the Developers screen

- **Developers** sign in straight to this screen; it is the only screen they have.
- **Admins** find it under **Setup** → **Developers** in the sidebar.

If you need this screen and do not see it, ask an admin of your organisation to give you the developer role. See [Team and organisation](https://docs.wandura.ai/partners/team).

## Scopes

Each key carries one or more scopes, and can only call the endpoints its scopes allow. Which scope opens which endpoint is in one table: [Authentication · Scopes](https://docs.wandura.ai/developers/authentication#scopes).

> **Warning:** If a playback key leaks, anyone can stream your licensed films. Revoke it immediately. The portal shows this warning on the card and again next to the new key.

## Create a key

1. Open **Developers**.
2. Under **Create a key**, enter a **Label** that says where the key is used, for example `cms-prod`. Up to 80 characters.
3. Under **What will this key do?**, pick a purpose: **Stream films in an app**, **Stream open video (fitness…)** (asks you to pick an app), **Sync catalog to your CMS** or **Receive creatives / webhooks**. To choose scopes yourself, pick **Advanced: choose scopes**.
4. Press **Create key**.
5. Copy the key from the box that appears, using **Copy key**, and store it in your secrets manager.
6. Press **I saved it** to close the box.

> **Warning:** The full key is shown only once. Wandura cannot show it again. If you lose it, rotate the key or create a new one.

Keep keys on your servers only. Never put a key in a browser page, a mobile app or a public repository.

## The key list

The **Keys** list shows every key of your organisation, newest first. For each key you see:

- The first characters of the key followed by `…`, and its label.
- Its scopes.
- Its status: **Never used**, **Last used** *date and time*, or **Revoked**.

## Rotate a key

Rotating replaces a key's secret and keeps its label and scopes.

1. Press **Rotate** on the key.
2. Confirm with **Rotate key**. The current secret stops working within seconds (see [Security](https://docs.wandura.ai/developers/concepts/security#key-lifecycle)).
3. Copy the new key from the box that appears. As with a new key, it is shown only once.

Update your servers right after rotating: there is no overlap. A rotated key keeps its API version pin; a new key gets the latest version. You cannot rotate a revoked key. Playback keys rotate like any other key; to switch without downtime, create a second playback key, deploy it, then revoke the old one.

## Revoke a key

1. Press **Revoke** on the key.
2. Confirm with **Revoke key**.

New requests with the key are refused within seconds, and revoking cannot be undone. Tickets already issued keep playing until they expire (at most 30 minutes). The key stays in the list marked **Revoked**.

| Key type | Developer | Admin |
|---|---|---|
| Any key of your organisation, playback keys included | Rotate, revoke | Rotate, revoke |

> **Warning:** Revoking a playback key stops new playback in your apps within seconds. If you think the key has leaked, revoke it anyway, then create a new playback key for your servers and tell Wandura. The full runbook: [Security · If a key leaks](https://docs.wandura.ai/developers/concepts/security#leaked-key).

## Next steps

- [Authentication](https://docs.wandura.ai/developers/authentication)
- [API reference](https://docs.wandura.ai/developers/reference/overview)