# Keys

A key lets your programs use your plan.

## Make a key

On your [account page](/account), name the key and press **Make a key**. The whole key is shown once. Copy it then; we can't show it again.

You can have up to 10 keys. Give each program its own, so you can revoke one without stopping the others. Every key shares your plan's one allowance.

## Send it

Send it in the `Authorization` header on every request:

```
Authorization: Bearer bullpen_…
```

Never put it in a URL. A request with a key in its query string gets a `400` and does nothing.

## Keep it secret

A key is like a password. Keep it in an environment variable or a secrets manager, never in code you commit or share. You answer for everything done with your keys.

Keys don't expire. To rotate one, make a new key, move your program to it, then revoke the old one.

## Revoke a key

Press **Revoke** beside it on your account page, then confirm. Programs using it get a `401` at once. Revoking can't be undone.

## If a key leaks

Revoke it and make a new one.

## What a key looks like

`bullpen_` and 38 letters and digits. Treat it as an opaque string: its length may change.

## For AI agents

Read the key from `BULLPEN_KEY`. Never ask a person to paste it into a chat. If a request gets a `401`, send them to bullpen.news/account to make a key.