# Get an API key

## 1. Prerequisites

Before using Rokid OpenAPI, activate an enterprise account on the Rokid platform and obtain an API key for authentication.

## 2. Obtaining API keys

Contact your sales or business counterpart and request OA approval for account access and **AK/SK** credentials. The API key corresponds to **accessKey** in that bundle.

## 3. Using the API key

- Include it in requests for authentication via the HTTP headers below.

| Header | Value |
| --- | --- |
| Content-Type | application/json |
| Authorization | Bearer openApi-Key |

- Do not expose API keys in public repositories or clients to avoid security or billing risks.

## 4. Lifetime

Created API keys expire. You can configure validity when provisioning; default validity is **1 month**.

## FAQ

- **Q:** How many keys can one enterprise account create?  
  **A:** There is currently no hard cap, but prefer **one key per app or service** to limit blast radius if a key leaks.

- **Q:** After the company is deregistered, do keys still work?  
  **A:** No. All keys issued to that account become invalid for OpenAPI calls.
