# Managing Your Elicit API Keys

The Elicit API lets you access Elicit's research capabilities programmatically: search 138 million+ academic papers and generate automated research reports from your own code, scripts, and workflows.

Visit [docs.elicit.com](http://docs.elicit.com) for current API usage, endpoints, rate limits, and pricing.

# Creating an API key

Click on your name at the bottom left of any page, and then click Developer.

![](https://downloads.intercomcdn.com/i/o/sumscdci/2571723526/a45f0aa4fa48619730938e1a6325/Screenshot+2026-07-28+at+3_53_13%E2%80%AFPM.png?expires=1789711200&signature=40a3d9013f2c37bc6f4972f6d4e284a902a44a396b75a13dcef413dc7ce2b604&req=diUgF858noRdX%2FMW3nq%2BgaSCAInRO%2FQgoZZNWs5wd3bUmiWwe4cuG8qlAbCh%0AgzVZEFRzQ4uerT5HEzlb5SteYTM%3D%0A)

Click **Create API key**.

![](https://downloads.intercomcdn.com/i/o/sumscdci/2571724344/0860411450adb677e1e8324023f7/Screenshot+2026-07-28+at+3_53_34%E2%80%AFPM.png?expires=1789711200&signature=0d0885925b14fbd5d5cd96a11bfe22f3d8a1d71e360d163566c846916371a51e&req=diUgF858mYJbXfMW3nq%2BgY3cd%2FKsEAB2dGJOVzidIzXsW0Ol5isYkaQY5IZZ%0Ax4MWRzHf7nsbOlv3Pid1qv330NM%3D%0A)

Give your key a descriptive name (e.g. "Literature review pipeline" or "Systematic review automation").

Your new key will be displayed once. Copy it immediately and store it somewhere secure. The full key will not be shown again.

# Viewing your keys

The API Keys table in the Developer panel shows all of your active keys, including:

- **Name:** the label you gave the key

- **Key:** the key prefix (the rest is hidden for security)

- **Created:** when the key was created

- **Last used:** when the key was last used to make an API request, or "Never" if it hasn't been used yet

# Deleting a key

- Click the trash icon next to the key you want to remove.

- Confirm deletion in the pop up.

Deleted keys are immediately and permanently deactivated. Any applications or scripts using the key will start receiving `401 Unauthorized` errors. This action cannot be undone. You'll need to create a new key if you need access again.

# Security best practices

- Never share your API key or commit it to version control.

- Use environment variables or a secrets manager to store keys in your applications.

- Create separate keys for separate integrations to revoke access granularly.

- Delete keys you're no longer using.