API Key Management

Creating API keys

Each API key represents a named agent. Go to Settings → API Keys → Create Key and give it a descriptive name (e.g., “research-agent”, “data-pipeline”). The name helps you identify usage in logs and billing.

Key format

All Volspan API keys follow this format:

• vc_live_ — fixed prefix identifying this as a Volspan key
• 32 random characters — cryptographically random alphanumeric string
• Total length: 40 characters

Security model

Your full API key is shown exactly once at creation time. After that, we store only:

• Argon2id hash — used to verify the key on each request. Irreversible.
• 12-character prefix — stored in plaintext for display purposes (e.g., vc_live_aBcD...).

If you lose a key, you cannot retrieve it. Create a new one and revoke the old one.

Revoking keys

Go to Settings → API Keys, find the key by its prefix or name, and click Revoke. Revocation is immediate — any in-flight runs will complete, but new requests with that key will be rejected. Revoked keys cannot be restored.

Best practices

• One key per agent. This gives you per-agent billing visibility and the ability to revoke individual agents without affecting others.
• Rotate regularly. Create a new key, update your agent config, then revoke the old key. We recommend rotating every 90 days.
• Never commit keys to source control. Use environment variables or secrets managers. The vc_live_ prefix makes it easy to scan for accidental exposure.
• Use descriptive names. When you have 20 agents, “research-agent-prod” is easier to audit than “key-3”.
• Set spend limits. On Team plans and above, you can set per-agent spend limits to prevent runaway costs.