# API keys

An **API key** is how a bot identifies itself to Zulip. Anyone with a
bot's API key can impersonate the bot, so be careful with it!

## Get a bot's API key

{settings_tab|your-bots}

1. Click **Active bots**.

1. Find your bot. The bot's API key is under **API KEY**.

## Get your API key

Anyone with your API key can impersonate you, so be doubly careful with it.

{settings_tab|account-and-privacy}

1. Under **API key**, click **Show/change your API key**.

1. Enter your password, and click **Get API key**. If you don't know your
   password, click **reset it** and follow the
   instructions from there.

1. Copy your API key.

## Invalidate an API key

To invalidate a key, follow the instructions above, and click
**Generate new API key** or click the **refresh**
(<i class="fa fa-refresh"></i>) icon as appropriate.

This will generate a new key for you or the bot, and invalidate the old one.