> ## Documentation Index
> Fetch the complete documentation index at: https://docs.custral.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Applications & API keys

> Register an application and mint the API keys your integration authenticates with.

## Overview

An **application** is a container for the API keys your integration uses to talk to the Custral [API](/dev/api-reference/overview). You create an application, then mint one or more keys under it, so you can rotate or revoke a single key without disturbing the others.

Manage them at **Settings → Applications**.

## Create an application

<Steps>
  <Step title="Open Applications">
    Go to **Settings → Applications** and click **Create Application**.
  </Step>

  <Step title="Name it">
    Give it a name you'll recognize later: "Production backend", "Zapier", etc. Each application shows a status and a created date.
  </Step>

  <Step title="Open the application">
    Click the application row to open its detail page, where its keys live.
  </Step>
</Steps>

## Mint an API key

From an application's detail page, choose **Add New API Key**:

* **Key name**: a label for this key (e.g. "Development key").
* **Key type**:
  * **Publishable (Frontend)**: safe to use in client-side code (for example, the browser widget).
  * **Secret (Backend)**: server-side access; **never expose it in a browser or commit it to source control**.

A key's **scopes** determine which routes it can call. See [Authentication & scopes](/dev/auth/overview).

<Warning>
  A secret key grants server-side access to your workspace. Store it in a secret manager, never in client code or version control. If one leaks, revoke it here and mint a replacement.
</Warning>

## Rotate & revoke

Because keys live under an application, you can mint a replacement, move traffic to it, then revoke the old one, with zero downtime for your other keys.

## Troubleshooting

| Symptom                                  | Likely cause                           | What to check                                                                           |
| ---------------------------------------- | -------------------------------------- | --------------------------------------------------------------------------------------- |
| API returns `401`                        | Missing, malformed, or revoked key     | Confirm the key is active and sent correctly. See [Authentication](/dev/auth/overview). |
| API returns `insufficient_scope`         | The key lacks the scope for that route | Use a key whose scopes cover the call.                                                  |
| A publishable key is rejected on a write | Publishable keys are frontend-scoped   | Use a secret key for backend / write calls.                                             |

## Related

* [Authentication & scopes](/dev/auth/overview)
* [Applications API reference](/dev/api-reference/applications)
* [Quickstart](/dev/getting-started)


## Related topics

- [Applications & keys](/dev/api-reference/applications.md)
- [Authentication](/dev/auth/overview.md)
- [MCP Server](/dev/mcp/overview.md)
- [API Reference](/dev/api-reference/overview.md)
- [Introspect the current key](/api-reference/identity/introspect-the-current-key.md)