# Keys and review A key lets a program act for you. Which kind you get depends on what the program needs to do, and some permissions are checked by a person at Bynefit before the key is released. ## Pick the right kind | Kind | What it can do | Where | | --- | --- | --- | | **Developer key** `bapi_pk_…` | Read public community data and submit resources for review. Anyone with an account can make one, instantly, without a Space. | [/dash/developers/keys](https://bynefit.com/dash/developers/keys) | | **Space key** `bapi_tk_…` | Work with your own Space's data, receive webhooks. A Space admin makes it, and some permissions need review first. | [/dash/integrations/api-tokens](https://bynefit.com/dash/integrations/api-tokens) | | **Browser key** `bapi_pk_…` from your Space | Loads your Space's embed widget on your own website. It is safe to put in a web page because it can do nothing else, and it only works on the websites listed under Embeds. | [/dash/integrations/api-tokens](https://bynefit.com/dash/integrations/api-tokens), then *Create key* and choose *Run in a visitor's browser* | | **Test key** `bapi_tk_test_…` or `bapi_pk_test_…` | Answers like a Space key or a developer key, with sample data. Ready straight away with any permission, including changing a directory, because nothing it does reaches real information. See [Test mode](https://bynefit.com/docs/test-mode). | Either page above, then *Create key* and choose *Test* | | **Agent key** `bapi_ag_…` | A key made for an AI agent. It reads only what you tick, expires within 90 days, starts in its own test mode (a smaller daily ceiling on real information, not the sandbox), and lists every call. The agent asks for anything more and its owner decides. A Space manager or admin makes it. [How agent keys work](https://bynefit.com/docs/agent-keys). | [/dash/integrations/agent-keys](https://bynefit.com/dash/integrations/agent-keys) (Available) | Not sure which one you need? Reading data from a server takes a Space key. Running in a visitor's browser takes a browser key. An AI agent reading your Space takes an agent key. Receiving events takes a webhook and its signing secret, not a key. Older embeds use a widget key that starts with `wk_`, shown masked on [/dash/integrations/embeds](https://bynefit.com/dash/integrations/embeds). Widget keys were switched off on 20 October 2026, so move embeds to a browser key or a Space key with the widget permission. See [Migrating from the legacy endpoint](https://bynefit.com/docs/legacy-sunset). Handing a key to an AI agent? Make it an [agent key](https://bynefit.com/docs/agent-keys), not a Space key: it is named after the agent, runs out on its own, and you can pause it in one click. For the public directory alone, a developer key named after the agent works too. [Building with an AI agent](https://bynefit.com/docs/ai-agents) has the rest. ## When a permission needs review Some permissions reach sensitive data or let a key change things. When you ask for one, the page asks what the key is for, in at least 20 characters. Bynefit reviews the request, usually within one business day, and emails you when it is approved. The key itself is withheld until then, and you collect it on the same page once it is approved. Test keys skip the review. Make one with the same permission and build against sample data while the live request waits. > **A request waiting for review is not an error.** The page shows it as waiting. Nothing about the key changes until a person at Bynefit has looked at it. ## Keep a key safe - The full key is shown once, when you create it. Put it in an environment variable such as `BYNEFIT_API_KEY` and keep it out of your code. - Use one key per program, with a name that says which one, so a leak is easy to trace and easy to end. - Never paste a key into a support message. Name the key instead, and we can find it. ## Revoke a key Open the page where you made the key and choose *Revoke* on its row. An agent key can also be paused, which stops it at once and can be undone by its owner. Revoking ends access immediately and cannot be undone, and any program still using the key starts getting `401` errors. Make a new key and update the program. ## Next steps - [Make your first call](https://bynefit.com/docs/getting-started) with a developer key. - [Authentication](https://bynefit.com/docs/authentication) shows how to send the key. - [Webhooks](https://bynefit.com/docs/webhooks) use a signing secret instead of a key. --- Source: https://bynefit.com/docs/keys Checked against the live API on October 10, 2026.