> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and project credentials

> Issue and revoke organization keys and project-scoped titan_pt_ credentials without crossing authority boundaries.

Polymorfa has distinct organization and project credentials.

| Kind               | Prefix       | Authority                                                                              |
| ------------------ | ------------ | -------------------------------------------------------------------------------------- |
| Organization key   | `titan_…`    | Organization-wide server authority; created through the authenticated Console key flow |
| Project credential | `titan_pt_…` | One organization and project, plus an explicit set of scopes                           |

The full token is returned once. Store it securely when it is created; the
Console cannot reveal it again.

## Create a project credential

1. Open the project in the Console.
2. Open **Settings → API Keys** and choose **Create project key**.
3. Enter a label, select the smallest scope set required by the integration,
   and choose an expiry.
4. Create the credential and copy the full token immediately.

Project credentials require at least one project-safe scope. See
[Authentication](/api/authentication#requestable-project-token-scopes) for the scope list.

## Review and revoke

The Console lists each credential's prefix, last four characters, label,
scopes, expiry, creation time, last use, and revocation time. It never displays
the full token again.

Revoke a credential from the same screen. Confirm that the integration has
switched to its replacement before revoking a credential during planned
rotation.

## Organization keys

Open the team without selecting a project, then open **Settings → Team API
Keys** and choose **Create team key**. The public Platform API does not
provide key or token management operations.

## Safety rules

* Use a project credential for workloads that only need one project.
* Never use a client token to mint another credential.
* Rotate by deploying the new credential before revoking the old one.
* Treat `404 credential not found` as an absent or inaccessible credential. Do
  not use identifiers from another organization or project.