API Keys

API keys authenticate requests to the UploadKit REST API and SDK. Each project has its own keys, and keys come in two environments: live and test.

Key types

Always use a test key during development. Switch to a live key only when deploying to production.

Creating an API key

1. Navigate to API Keys in the sidebar
2. Click Create Key
3. Give the key a descriptive name (e.g., "Production Server", "GitHub Actions CI")
4. Select Live or Test
5. Click Create

Key display

After creation, keys are displayed in masked form:

uk_live_xxx...xxxabc

The first few and last few characters are shown for identification. You can use this to confirm which key is in use in your application.

Using API keys in your application

Set the key as an environment variable — never hardcode it:

UPLOADKIT_API_KEY=uk_live_xxxxxxxxxxxxxxxxxxxxx

The API key is server-side only — it is never exposed to the browser. The @uploadkitdev/next handler uses this key to authenticate with the UploadKit API. React components communicate through your local /api/uploadkit endpoint without needing the key.

Copying a key

If you need to retrieve a key value and you still have it in your environment, you can confirm you have the right key by comparing the masked display in the dashboard with your stored value.

If you have lost the key, you must revoke it and create a new one.

Revoking a key

To revoke an API key:

1. Find the key in the API Keys list
2. Click the Revoke button (trash icon)
3. Confirm in the dialog

Revoked keys stop working immediately. Any requests using the revoked key receive a 401 Unauthorized response.

Key limits by tier

If you reach your key limit, revoke unused keys or upgrade your plan.