# Authentication

The TiDB Cloud API uses [HTTP Digest Authentication](https://en.wikipedia.org/wiki/Digest_access_authentication). It protects your private key from being sent over the network. For more details about HTTP Digest Authentication, refer to the [IETF RFC](https://datatracker.ietf.org/doc/html/rfc7616).

## API key overview

- The API key contains a public key and a private key, which act as the username and password required in the HTTP Digest Authentication. The private key only displays upon the key creation.
- The API key belongs to your organization and acts as the `Organization Owner` role. You can check [permissions of owner](https://docs.pingcap.com/tidbcloud/manage-user-access#configure-member-roles).
- You must provide the correct API key in every request. Otherwise, the TiDB Cloud responds with a `401` error.

## API key management

### Create an API key

Only the **owner** of an organization can create an API key.

To create an API key in an organization, perform the following steps:

1. In the [TiDB Cloud console](https://tidbcloud.com), switch to your target organization using the combo box in the upper-left corner.
2. In the left navigation pane, click **Organization Settings** > **API Keys**.
3. On the **API Keys** page, click **Create API Key**.
4. Enter a description for your API key.
5. Configure the role and scope for the API key. For more information about the permissions of a role, see [User roles](https://docs.pingcap.com/tidbcloud/manage-user-access/#user-roles).
6. Click **Generate API Key**. Copy and save the public key and the private key.
7. Make sure that you have copied and saved the private key in a secure location. The private key only displays upon the creation. After leaving this page, you will not be able to get the full private key again.
8. Click **Done**.

### View details of an API key

To view details of an API key, perform the following steps:

1. In the [TiDB Cloud console](https://tidbcloud.com), switch to your target organization using the combo box in the upper-left corner.
2. In the left navigation pane, click **Organization Settings** > **API Keys**.
3. You can view the details of the API keys on the page.

### Edit an API key

Only the **owner** of an organization can modify an API key.

To edit an API key in an organization, perform the following steps:

1. In the [TiDB Cloud console](https://tidbcloud.com), switch to your target organization using the combo box in the upper-left corner.
2. In the left navigation pane, click **Organization Settings** > **API Keys**.
3. On the **API Keys** page, click **...** in the API key row that you want to change, and then click **Update Role**.
4. You can update the description and role of the API key.
5. Click **Update**.

### Delete an API key

Only the **owner** of an organization can delete an API key.

To delete an API key in an organization, perform the following steps:

1. In the [TiDB Cloud console](https://tidbcloud.com), switch to your target organization using the combo box in the upper-left corner.
2. In the left navigation pane, click **Organization Settings** > **API Keys**.
3. On the **API Keys** page, click **...** in the API key row that you want to delete, and then click **Delete**.
4. Click **I understand, delete it.**