# Authentication
The TiDB Cloud API uses [HTTP Digest Authentication](https://en.wikipedia.org/wiki/Digest_access_authentication). It protects your private key from being sent over the network. For more details about HTTP Digest Authentication, refer to the [IETF RFC](https://datatracker.ietf.org/doc/html/rfc7616).
## API key overview
- The API key contains a public key and a private key, which act as the username and password required in the HTTP Digest Authentication. The private key only displays upon the key creation.
- The API key belongs to your organization and acts as the `Owner` role. You can check [permissions of owner](https://docs.pingcap.com/tidbcloud/manage-user-access#configure-member-roles).
- You must provide the correct API key in every request. Otherwise, the TiDB Cloud responds with a `401` error.
## API key management
### Create an API key
Only the **owner** of an organization can create an API key.
To create an API key in an organization, perform the following steps:
1. Click **Organization** in the lower-left corner of the TiDB Cloud console.
2. Click **Organization Settings**. The organization settings page is displayed.
3. Click the **API Keys** tab and then click **Create API Key**.
4. Enter a description for your API key. The role of the API key is always `Owner` currently.
5. Click **Next**. Copy and save the public key and the private key.
6. Make sure that you have copied and saved the private key in a secure location. The private key only displays upon the creation. After leaving this page, you will not be able to get the full private key again.
7. Click **Done**.
### View details of an API key
To view details of an API key, perform the following steps:
1. Click **Organization** in the upper-right corner of the TiDB Cloud console.
2. Click **Organization Settings**. The organization settings page is displayed.
3. Click the **API Keys** tab.
4. You can view the details of the API keys in the menu.
### Edit an API key
Only the **owner** of an organization can modify an API key.
To edit an API key in an organization, perform the following steps:
1. Click **Organization** in the upper-right corner of the TiDB Cloud console.
2. Click **Organization Settings**. The organization settings page is displayed.
3. Click the **API Keys** tab.
4. Click **Edit** in the API key row that you want to change.
4. You can update the API key description.
5. Click **Done**.
### Delete an API key
Only the **owner** of an organization can delete an API key.
To delete an API key in an organization, perform the following steps:
1. Click **Organization** in the upper-right corner of the TiDB Cloud console.
2. Click **Organization Settings**. The organization settings page is displayed.
3. Click the **API Keys** tab.
4. Click **Delete** in the API key row that you want to delete.
5. Click **I understand the consequences, delete this API Key.**