> AffiliateOS Help Center. Index of every article for AI tools: https://www.affiliateos.ai/help/llms.txt

# Create, rotate and revoke API keys

Account, team and security · For publishers, networks · Updated 30 October 2026
Web version: https://www.affiliateos.ai/help/account/create-rotate-revoke-api-keys

Publishers create keys under **My Profile**, then **API Keys**; networks under **Workspace settings**, then **API Keys**. Each key is shown once, when you create it. To rotate, create the new key, deploy it, check it works, then revoke the old one.

## Before you start

- **Publishers:** you're the account's Owner or an Admin. Keys are managed only from a signed-in dashboard: an API key can't create, list or revoke keys.
- **Networks:** you're signed in as the network's owner; teammates can't see or manage keys. The line above your key list, such as "Used 1 / 2 keys", shows how many keys your account can hold. Need more? [Ask us](https://www.affiliateos.ai/contact?topic=support).

## Create a publisher key

### My Profile, then API Keys

The card lists every key on the account, with its **Created**, **Expires** and **Last used** dates.

### Name it, then Generate Key

Type a name in **Key name (optional)**, such as Production server, and choose **Generate Key**. A name tells keys apart when you rotate later.

### Copy it now

Choose **Copy key** and store it on your server. It starts with `pk_` and won't be shown again. Your server sends it in the `x-api-key` header. New publisher keys don't expire: they work until you revoke them.

## Create a network key

### Workspace settings, then API Keys

The list shows each key's **Prefix**, **Created** and **Expires** dates.

### Generate Key

Choose **Generate Key**, then **Copy key**, and store it on your server. It starts with `ak_` and won't be shown again. Your server sends it in the `x-api-key` header to `https://affiliateos.xyz/network-api/offers`.

### Note the expiry date

Network keys expire, 90 days after you generate them by default. The **Expires** column shows each date: rotate before it.

## Rotate a key without downtime

### Generate the new key

Publishers can hold up to five keys at once, so there's room for the new one beside the old. Networks hold one key unless we raise the limit: ask us first, and the new key goes live before the old one is removed. If you can't wait, remove the old key, generate the new one and deploy it at once, and expect calls to fail in between.

### Deploy it and make one call

Put the new key on your server and make one request with it, such as a call to the offer list, and check it answers 200.

### Revoke the old key

Publishers choose **Revoke** on the old key's row and confirm. Networks choose **Remove**. The key leaves the list and stops working.

### Check it worked

A call with the old key answers 401 with `Invalid or expired API key`. Publishers also see the new key's **Last used** date update once your server calls with it.

> **A revoked publisher key can work for up to 30 more seconds.** The offer list and offer availability calls may still accept it for up to 30 seconds after you revoke it. Every other call refuses it at once.

Hosts, headers and every key type side by side: [Hosts and keys](https://www.affiliateos.ai/help/developers#keys).