# API keys An **API key** is how a bot identifies itself to Zulip. Anyone with a bot's API key can impersonate the bot, so be careful with it! ## Get a bot's API key {settings_tab|your-bots} 1. Click **Active bots**. 1. Find your bot. The bot's API key is under **API KEY**. ## Get your API key Anyone with your API key can impersonate you, so be doubly careful with it. {settings_tab|account-and-privacy} 1. Under **API key**, click **Show/change your API key**. 1. Enter your password, and click **Get API key**. If you never had a password, click **Never had one? Forgotten it?** and follow the instructions from there. 1. Copy your API key. ## Invalidate an API key To invalidate a key, follow the instructions above, and click **Generate new API key** or click the **refresh** () icon as appropriate. This will generate a new key for you or the bot, and invalidate the old one.