> ## Documentation Index
> Fetch the complete documentation index at: https://palladiumai.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing API Keys for Your Marketplace Subscriptions

> Find, copy, and use API keys for your active Palladium AI marketplace subscriptions to authenticate requests to built-in and custom API products.

Every active marketplace subscription comes with an API key — a credential your team uses to authenticate requests to the subscribed API product. Palladium AI provisions a key automatically when you subscribe to a plan. This page explains where to find your keys, how to include them in requests, and what to expect when your plan changes.

<Warning>
  Keep your API key secret — do not commit it to source control or share it publicly. Anyone who obtains your key can make API calls that count against your plan's quota.
</Warning>

## Where to find your API keys

Navigate to your team workspace and select **APIs** in the sidebar. Open the **My Subscriptions** tab to see all active subscriptions for your team. Each subscription row displays the associated API key alongside the product name and plan details. Click the copy icon next to a key to copy it to your clipboard.

## Using an API key

Include your API key as a Bearer token in the `Authorization` header of every request to the product's endpoint. The example below shows a request to the Risk Score API:

```bash theme={null}
curl -H "Authorization: Bearer YOUR_API_KEY" \
     https://api.palladiumlabs.online/v1/risk-score
```

Replace `YOUR_API_KEY` with the key shown in your **My Subscriptions** view. The same pattern applies to all marketplace products — built-in and custom alike.

## Key lifecycle

API keys are tied directly to your subscription plan. The table below summarises how key state changes as your subscription changes:

| Event                      | Key behaviour                                                |
| -------------------------- | ------------------------------------------------------------ |
| New subscription activated | A new API key is provisioned for the plan.                   |
| Plan upgraded              | A new key is issued; the previous key is revoked.            |
| Plan downgraded            | A new key is issued; the previous key is revoked.            |
| Subscription cancelled     | The key is revoked and will no longer authenticate requests. |

After upgrading or downgrading, update any services or environment variables that store your API key before the old key is revoked to avoid request failures.

## Rate limits and quotas

Each plan defines two usage boundaries that govern how your team can call the API:

* **Monthly quota** — the maximum number of calls allowed in a calendar month. Once your team reaches the quota ceiling, further calls will be rejected until the next billing period begins.
* **Rate limit** — the maximum number of calls allowed per minute at any point in time. If your team exceeds the rate limit, the API returns **HTTP 429 Too Many Requests**. Back off and retry after a short delay.

Both limits are displayed in the plans table when you browse the marketplace. Choose a plan whose quota and rate limit comfortably cover your team's expected traffic.