# API keys and OTA Publish IDs

Source: https://rerune.io/docs/credentials

Choose between API keys and OTA Publish IDs for management, automation, and runtime delivery, and learn how to create, expire, and rotate them.

## Two credentials, two purposes

Source: https://rerune.io/docs/credentials#types

| Credential | Use | Where it belongs |
| --- | --- | --- |
| API key | Authenticated management and CLI synchronization under the account permissions. | Server environment, local untracked .env, or CI secret store. |
| OTA Publish ID | Read-only SDK requests for a project published translation content. | The SDK runtime configuration for the intended project. |

The CLI authenticates management requests with X-API-Key. SDK translation delivery puts the OTA Publish ID in the request URL path and sends no identity header. These credentials are not interchangeable. Keep custom management integrations on a trusted server.

## Create and use an API key

Source: https://rerune.io/docs/credentials#api-key

Open the API key area in your account and create the credential needed for your workflow. Copy it into the local environment or CI secret store. The CLI reads RERUNE_API_KEY; do not place the secret in a public frontend environment variable.

When replacing a management key, update the systems that use it and verify their requests before removing the old credential. If a request is forbidden, check the account permissions as well as the credential.

- [Manage API keys](https://rerune.io/translator/api-key)
- [Localization API overview](https://rerune.io/localization-api)

## Generate an OTA Publish ID

Source: https://rerune.io/docs/credentials#ota-id

Open the project OTA Publish IDs settings and generate an ID. You can set an expiration time. Copy the generated value when shown; the plaintext value is displayed only at creation. Put it in the matching SDK configuration.

Terminal · create an ID for the configured project:

```
rerune project ota-id create
```

The CLI command prints the new value once and does not write it to rerune.json. It requires an authenticated account and a project target. Use command-specific help for an explicit project or expiration.

> **Read-only does not make text confidential:** Client applications carry their OTA Publish ID. Treat the published translation payload as content available to that application audience and keep secrets or personal records out of translation values. When project staging is enabled, clients with that same ID can also request enabled drafts by opting into staging mode.

- [OTA staging and live preview](https://rerune.io/docs/staging)

## Expiration and rotation

Source: https://rerune.io/docs/credentials#expiry

When an OTA ID expires or is deleted, clients using it cannot rely on future successful fetches. Previously cached data can remain available according to SDK behavior. Plan rotation around how your apps receive configuration updates.

Generate a replacement, update the intended clients, and verify delivery. Remove the old ID only when you are ready to stop future requests from clients that still use it. Deleting an ID does not update the value embedded in an installed app.

- See also: [Troubleshooting](https://rerune.io/docs/troubleshooting)

---

Part of the ReRune documentation (https://rerune.io/docs). Every chapter with a summary: https://rerune.io/llms.txt. Every chapter in one file: https://rerune.io/llms-full.txt. ReRune is not Rerun (rerun.io), the robotics data visualization tool.