# API keys: permissions, channels, IPs, lifetime, and replacing keys.

Every API v2 request carries one API key in the `Authorization: Bearer` header. Klik Flow stores only the key's fingerprint, so a lost key cannot be shown again: replace the key.

Sumber: https://klikflow.id/docs/en/api/authentication

## Live keys and test keys

- `kf_live_…`: sends for real and uses the plan's message quota. Needs a plan with the API feature.
- `kf_test_…`: sends only to test numbers, with its own limits (60 requests per minute, 100 messages per day). Can be created on every plan. See the Test mode guide.
- The `Klikflow-Mode` header in every response holds `live` or `test`, so your system can confirm which key is installed.

## Key permissions

Choose only the permissions you need when you create the key. Each permission must also be held by the key creator's role when the request comes in: if the role is changed, the key narrows with it. The permission each endpoint needs is listed on its reference page.

- `business:read`: business and channels.
- `contacts:read`, `contacts:write`: contacts and custom fields.
- `conversations:read`: conversations and message content, limited to the chats the key's creator can see.
- `messages:send`: send messages and reply to conversations. `messages:new`: start WhatsApp (scan QR) chats to new numbers.
- `templates:read`, `templates:write`: WhatsApp Official templates.
- `webhooks:manage`: webhooks to your system, live keys only.

## Channels and IPs

A key can be limited to specific WhatsApp numbers; without a limit, the key uses every number its creator may use. Also fill in the server IPs allowed to use the key: IPv4/IPv6 addresses or IPv4 ranges such as `198.51.100.0/24`. Requests from other IPs are refused with `ip_not_allowed`.

## Lifetime

Choose until revoked, 30 days, 90 days, or 1 year. Expired keys are refused with `key_expired`; the date appears in the key list.

## Replacing a key

Press Replace (Ganti) on the key. A new key is created with the same permissions, channels, IPs, and lifetime, while the old key keeps working for the grace period you choose (stop immediately, 24 hours, 3 days, or 7 days). Install the new key on your server within that period. Revoke (Cabut) stops a key at once, including its grace period.

## Storing keys

Keep keys in environment variables or the server's secret store. Do not put them in a mobile app, web page code, or a repository. Call the API from your server; the API does not accept calls straight from a browser.