> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generating a new API key

> How to reset your Draftable API auth token from your account, what it affects, and what to prepare before you do it.

If your Draftable API auth token has been exposed, or you simply rotate credentials on a schedule, you can generate a new one yourself from your account. You do not need to contact support.

<Warning>
  Resetting a token takes effect **immediately** and cannot be undone. The old token stops working the moment you reset it. Read the section below on what breaks before you press the button.
</Warning>

## Before you start

Resetting is instant and irreversible, so prepare first.

<Steps>
  <Step title="Know where the token is used">
    Every application, script, scheduled job and environment that authenticates with the token will stop working until updated. Make a list.
  </Step>

  <Step title="Have the update ready to deploy">
    The gap between resetting and deploying the new token is downtime for your integration. Have the configuration change staged and ready to ship.
  </Step>

  <Step title="Account for signed viewer URLs">
    Your auth token is the secret used to sign viewer URLs. Resetting it **invalidates every signed URL you have already issued**, including links already sent to users that they have not yet opened.
  </Step>

  <Step title="Pick your moment">
    Unless you are responding to an exposed token, reset during a quiet period rather than mid-business-day.
  </Step>
</Steps>

<Note>
  If you are responding to a **confirmed exposure**, reset immediately anyway. A short outage is far preferable to leaving a live credential in circulation.
</Note>

## Resetting the token

<Steps>
  <Step title="Sign in to your Draftable account">
    Go to [api.draftable.com/account/credentials](https://api.draftable.com/account/credentials).
  </Step>

  <Step title="Open API Credentials">
    Select **API Credentials** in the left-hand menu. You will see your **Account ID** and **Auth Token** sections, each listing a **Testing** and a **Live** entry.
  </Step>

  <Step title="Choose the right row">
    The testing and live tokens are reset **independently**. Check carefully which row you are about to reset, because resetting the live token affects production.
  </Step>

  <Step title="Select RESET">
    Select **RESET** on the row you want. A new token is generated and displayed immediately, replacing the old one.
  </Step>

  <Step title="Copy the new token and update your configuration">
    Update every place the old token was used, then confirm your integration is working again.
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/draftable/ddL0KnvVA8eox05C/images/draftable-api/api-credentials-page.png?fit=max&auto=format&n=ddL0KnvVA8eox05C&q=85&s=6de6d077e62f242bc1617ea48f5acbb9" alt="The API Credentials page in a Draftable account, showing the Account ID section with testing and live IDs, and the Auth Token section with a RESET button beside each token" width="2880" height="1520" data-path="images/draftable-api/api-credentials-page.png" />
</Frame>

<Note>
  The values in the screenshot above are placeholders. Your own account ID and auth token will be different.
</Note>

## What can and cannot be changed

|                | Can it be reset? | Why                                                                               |
| :------------- | :--------------: | :-------------------------------------------------------------------------------- |
| **Auth token** |        Yes       | It is a secret, equivalent to a password. It can and should be rotated if exposed |
| **Account ID** |        No        | It is bound to your account and is deliberately public, appearing in viewer URLs  |

<Warning>
  Because the account ID is exposed to your users by design, seeing it is not a security problem. Seeing your **auth token** is. If a user, a log file, a support ticket or a screenshot has ever shown your auth token, reset it.
</Warning>

## What resetting affects

| Affected                     | Detail                                                                                    |
| :--------------------------- | :---------------------------------------------------------------------------------------- |
| **API requests**             | Any request using the old token fails with 401 until updated                              |
| **Signed viewer URLs**       | All previously issued signed URLs stop working, because the token is the signing key      |
| **The other credential set** | Not affected. Testing and live are reset independently                                    |
| **Your comparisons**         | Not affected. Existing comparisons are untouched and remain accessible with the new token |
| **Your account ID**          | Not affected. It never changes                                                            |

<Tip>
  If you have emailed signed viewer URLs that recipients may not have opened yet, generate and resend fresh links after resetting. There is no way to keep old signatures valid.
</Tip>

## Good practice

* **Rotate the live token on a schedule**, not only after an incident
* **Store tokens in a secrets manager or environment variables**, never in source control
* **Use the testing token for development**, so the live token exists in fewer places and is exposed less often
* **Generate signed viewer URLs on demand** with short expiry windows, so a reset invalidates fewer links in flight
* **Enable multi-factor authentication** on the account itself, since anyone who can sign in can read and reset your credentials

## Related articles

<CardGroup>
  <Card title="Authenticating with the Draftable API" icon="key" href="/hc/en-us/articles/Draftable-API-authentication" iconType="solid" horizontal />

  <Card title="Private and public comparisons" icon="lock" href="/hc/en-us/articles/Draftable-API-private-comparisons" iconType="solid" horizontal />

  <Card title="Test and production accounts" icon="flask" href="/hc/en-us/articles/Draftable-API-test-and-production-accounts" iconType="solid" horizontal />

  <Card title="Multi-factor authentication" icon="shield-halved" href="/hc/en-us/articles/Draftable-API-multi-factor-authentication" iconType="solid" horizontal />
</CardGroup>