> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thunderphone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a server API key

> Mint an sk_live_ key from the dashboard for server-to-server calls to the ThunderPhone API.

Server API keys (`sk_live_...`) authenticate server-to-server calls to
the ThunderPhone API. Keys live under **Organization → Keys**.

<Warning>
  Server keys are secrets. Never ship one in client-side code — for
  browsers, use origin-locked
  [publishable keys](/api-reference/publishable-keys) (`pk_live_...`)
  instead.
</Warning>

<Steps>
  <Step title="Open the Keys tab">
    Go to **Organization → Keys** and click **Create key**.
  </Step>

  <Step title="Name it">
    Pick a name that says where the key will live — like "Production
    backend". Names are labels only; they don't affect access.
  </Step>

  <Step title="Create the key">
    Click **Create key** in the dialog. This generates the secret.
  </Step>

  <Step title="Copy it now">
    The full secret is shown **exactly once**. Copy it into your
    secret manager — after you leave, only the prefix remains visible.
  </Step>
</Steps>

## Use it

The key is bound to this organization, so requests need no org id —
just the Bearer header:

```bash theme={null}
curl https://api.thunderphone.com/v1/agents \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY"
```

From here, the [API quickstart](/quickstart) takes you to your first
call in three more requests.

## Rotate and revoke

Create a new key, move your services over, then delete the old one
from the same tab — the list shows each key's prefix and name so you
can tell them apart. Manage keys programmatically via the
[developer API keys reference](/api-reference/developer-api-keys).

<Note>
  Server API keys are machine credentials and are exempt from your
  organization's [**Require passkeys**](/guides/sso#security-policy)
  policy — that setting checks human sign-ins, not `sk_live_...` keys.
  Because of that, rotating and revoking keys promptly here is your
  main control over standing API access; if passkeys are required,
  the security policy panel shows how many active keys are currently
  exempt.
</Note>

<Tip>
  Ask the in-app copilot to "create an API key" and it will walk you
  through this flow, spotlighting each control live.
</Tip>

***

## Next steps

<CardGroup cols={2}>
  <Card title="API quickstart" icon="terminal" href="/quickstart">
    Agent, number, webhook, first call — four REST calls.
  </Card>

  <Card title="Authentication reference" icon="lock" href="/api-reference/introduction">
    How Bearer auth and org binding work.
  </Card>
</CardGroup>