# Getting API Access And Keys

> Learn where API Access appears, how to generate keys, and how to revoke or rotate keys safely.

> Create and manage API keys for approved Kommon Poll teams and integrations.

API Access is available only for teams or packages where the feature is enabled. If you belong to several teams, choose the team that owns the saved searches your integration needs.

If API Access is not available for the team or package you are using, contact Kommon Poll.

---

## 1. Create An API Key

1. Open Kommon Poll.
2. Go to **Integrations**.
3. Open **API Access**.
4. Choose **Create API Key**.
5. Give the key a descriptive name, such as `Power BI Production`, `Weekly Report Job`, or `Data Warehouse`.
6. Select the team the integration should access.
7. Create the key.
8. Copy the complete key immediately.
9. Store the key in a secure place before leaving the screen.

Use a separate key for each application and environment. This makes it possible to revoke one integration without affecting others.

---

## 2. Key Format And Storage

API keys use a `kp_live_...` format.

The full secret is shown when the key is created. It is not intended to be displayed again later.

Store API keys in:

- A secrets manager.
- A secure deployment variable.
- A server environment variable.

Do not store API keys in:

- Git repositories.
- Browser source code.
- Mobile application bundles.
- Shared screenshots.
- Query strings.
- Log files.

---

## 3. Replace A Lost Key

If the full key is lost, create a replacement key.

1. Create a new API key for the same team.
2. Update the integration to use the new key.
3. Confirm that `GET /v4/list` succeeds.
4. Confirm that the expected saved search appears.
5. Revoke the old key.

---

## 4. Revoke Or Rotate Keys

Revoke a key when:

- An integration is retired.
- A key may have been exposed.
- A team or vendor no longer needs access.
- The key was created for a temporary environment.

Rotate production keys periodically according to your organization's secret-management policy.

When rotating a key, confirm the new key works before revoking the old one.

---

## 5. Access Checklist

Before starting development:

- API Access is enabled for the correct team or package.
- The saved search exists in Kommon Poll.
- The API key was created for the team that owns the saved search.
- The full key is stored securely.
- The integration owner knows how to revoke the key.
- A first `GET /v4/list` request succeeds.
- The saved search `aid` is available from the list response.