> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cope.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API key integrations

> Create, store, rotate, deactivate, and delete COPE public API keys safely.

# API key integrations

API key integrations let server-side vendor systems call the COPE public API for one COPE business. Each key has a mode, a public key ID, a secret shown only once, an active state, and last-used metadata.

## Lifecycle

| Action     | Guidance                                                                                                    |
| ---------- | ----------------------------------------------------------------------------------------------------------- |
| Create     | Create a named integration in the COPE dashboard and copy the secret immediately.                           |
| Store      | Store the full token in a server-side secret manager. Do not expose secret keys in browsers or mobile apps. |
| Rotate     | Create a replacement key, deploy it, confirm traffic, then deactivate the previous key.                     |
| Deactivate | Deactivated keys stop authenticating and return `401 invalid_token`.                                        |
| Delete     | Delete keys that are no longer needed after confirming no clients use them.                                 |

## Key format

COPE secret keys use the format `cope_sk_<mode>_<key_id>_<secret>`. The key ID is safe to display for identification, but the secret tail is shown only once.

## Where keys are managed

Create, rotate, activate, deactivate, and delete API keys in the COPE dashboard under **Settings → API Keys**. The secret is shown only once, at creation and after a rotation.