PanaceaPanacea
Get started

Other

Log in
All guides

API Keys

Create and manage API keys to authenticate your widget and server-to-server calls.

2 min read280 words

API keys authenticate requests to Panacea from your server-side code and integrations.

Note: The chat widget does NOT use an API key. It authenticates via a short-lived JWT issued by POST /api/v1/auth/widget-token. See Embed the chat widget.

Opening API Keys

Go to Settings -> API Keys.

Key format

All keys follow the format pk_live_<token> or pk_test_<token>. The raw key is shown only once at creation — Panacea stores only a SHA-256 hash.

Creating a key

  1. Click New API key.
  2. Enter a descriptive name (e.g. Backend integration — prod).
  3. (Optional) Set an expiry date.
  4. Click Create.
  5. Copy the key immediately — it cannot be retrieved again. If lost, generate a new one.

Using a key

Include the raw key in the Authorization header of API requests:

curl https://panacea.aevr.online/api/v1/analytics \
  -H "Authorization: Bearer pk_live_xxxxxxxxxxxx"

Or in server-side code:

const response = await fetch(`${process.env.PANACEA_API_BASE}/api/v1/wiki`, {
  headers: {
    Authorization: `Bearer ${process.env.PANACEA_API_KEY}`,
  },
})

Never include your API key in client-side code or commit it to version control.

Using test keys

Keys with the pk_test_ prefix work the same as live keys but are intended for development and staging environments where you do not want to affect production data.

Revoking a key

Click the Delete icon next to the key. The key is invalidated immediately — any requests using it will receive 401 Unauthorized.

Security best practices

  • Use environment variables — never hardcode keys in source files.
  • One key per integration — use separate keys for different services so you can revoke one without affecting others.
  • Set expiry dates for keys given to contractors or temporary integrations.
  • Rotate keys if you suspect a key has been exposed.

Related guides