> ## Documentation Index
> Fetch the complete documentation index at: https://openwearables.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Manage API keys for the REST API and application credentials for the Mobile SDK from Settings → Credentials in the Open Wearables developer portal.

**Settings → Credentials** holds everything a client needs to talk to your deployment: API keys for the REST API and application credentials for the Mobile SDK. The tab also shows the **API Base URL** of the deployment with a copy button.

## API Keys

API keys authenticate requests to the REST API through the `X-Open-Wearables-API-Key` header and are used to embed widgets. See [Authentication](/docs/api-reference/introduction#authentication) for how to send them.

* **Create API Key** - give the key a name. The dialog then shows the full key with a copy button. The name is only a label, you can change it later.
* **The key is shown only once.** Open Wearables stores a hash of the key, so it cannot be retrieved later. The table shows just a short prefix (for example `sk-a1b2c3d…`) to help you tell keys apart. If you lose a key, rotate it.
* **Rotate** - generates a new key under the same name and shows it once. The previous key stops working immediately, so update every integration that used it.
* **Rename** - update the display name of a key.
* **Delete** - the key stops working immediately for every integration that uses it.

Send the key in the `X-Open-Wearables-API-Key` header of every request:

```bash theme={null}
curl http://localhost:8000/api/v1/users \
  -H "X-Open-Wearables-API-Key: sk-a1b2c3d4e5f60718293a4b5c6d7e8f90"
```

A missing or invalid key returns `401 Unauthorized`. See [Authentication](/docs/api-reference/introduction#authentication) for response formats and status codes.

### Keys are shared across the deployment

API keys belong to the deployment, not to the developer who created them. Every developer sees all keys and can create, rotate, rename, and delete any of them, including keys created by someone else. The **created by** attribute is audit information only. It does not grant ownership and does not restrict what other developers can do with the key. See [Team](/docs/developer-portal/settings/team#access-model) for the full access model.

## Applications

Applications are the credentials used by the [Mobile SDK](/docs/sdk). Each registered app gets an `app_id` and an `app_secret`.

* **Create Application** - give the app a name, for example "My iOS App". The dialog then shows the **App ID** and the **App Secret**.
* **The secret is shown only once.** Store it in your backend environment right away. If you lose it, rotate the secret and update your backend.
* **Rotate secret** - generates a new secret and shows it once. The previous secret stops working immediately.
* **Delete** - removes the application. SDK clients using its credentials can no longer authenticate.

<Warning>
  Keep the app secret on your backend. Never ship it inside a mobile app binary or expose it in client-side code.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.