> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/p0-management/generating-an-api-key.md).

# Generating an API key

{% hint style="warning" %}
API keys are legacy. For new integrations, prefer a Google Cloud service-account token, which is short-lived and needs no stored secret. See [Authenticating with the P0 API](/getting-started/authenticating-with-the-p0-api.md) for all authentication methods. This page documents the API-key option.
{% endhint %}

API keys let you authenticate with P0's Management API and integrate P0 into your infrastructure-as-code workflows. A P0 API key carries the full **Owner** role. You can use an API key to:

* Use the [Management API](/p0-management/management-api.md) to programmatically configure P0 settings
* Install and manage P0 using the [P0 Terraform Provider](https://github.com/p0-security/terraform-provider-p0)

## Prerequisites

You must have the **Owner** role in your P0 organization to generate API keys.

## Generate an API key

1. Navigate to **P0 Management** in the P0 dashboard sidebar.
2. Expand the **API Keys** section.
3. Click **Create a new API key**.
4. Enter a descriptive name for the key (for example, "Terraform CI/CD" or "Management API").
5. Click **Submit**.
6. Copy the API key immediately.

<figure><img src="/files/ndbts4t1D27RsUXgNKi1" alt="The API Keys section in P0 Management showing the Create a new API key dialog" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %}
**Copy your API key now.** The API key is only displayed once at creation time. You cannot retrieve it later. If you lose the key, you must generate a new one.
{% endhint %}

## Generate an API key using the API

You can also create, list, and delete API keys programmatically with the Management API. See the [API Key Management API](/p0-management/management-api/api-key-management-api.md) reference for the available endpoints, request and response formats, and authorization requirements.

## Using the API key

### With the Management API

Include the API key in the `Authorization` header of your API requests:

```bash
curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api.p0.app/o/{orgId}/...
```

### With the Terraform provider

Give the API key to the P0 Terraform provider in one of two ways.

Set the `P0_API_TOKEN` environment variable, and keep the token out of your configuration files:

```bash
export P0_API_TOKEN="YOUR_API_KEY"
```

```hcl
provider "p0" {
  org = "my-org"
}
```

Or set the `api_token` attribute on the `provider` block:

```hcl
provider "p0" {
  org       = "my-org"
  api_token = var.p0_api_token
}
```

The `api_token` attribute takes precedence when both are set.

You can use the provider to install integrations and to manage organization settings as code, including [role assignments](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/owner_user), the [access-duration policy](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/access_durations), and [expiry options](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/expiry_options). Managing organization settings requires provider version `0.50.0` or later. For the full provider reference, see the [P0 Terraform provider documentation](https://registry.terraform.io/providers/p0-security/p0/latest/docs).

## Best practices

* **Use descriptive names** for your API keys to identify their purpose.
* **Rotate keys regularly** as part of your security hygiene.
* **Store keys securely** using a secrets manager or environment variables. Never commit API keys to version control.
* **Delete unused keys** to minimize your attack surface.

## Related

* [P0 API overview](/getting-started/p0-api-overview.md)
* [Management API](/p0-management/management-api.md)
* [Role-Based Access Control](/p0-management/role-based-access-control.md)