# Keys and authentication

> Learn what your account key and your flow keys can do, and where each one is safe to use.

Source: https://voxio.in/docs/authentication · voxioagent 2.0.0 · Index: https://voxio.in/docs/llms.txt

Voxio has two kinds of key. Flow keys are public: they go in web pages. The account key is secret: it stays on your server.

## Key types

| Key | Where to find it | What it can do |
| --- | --- | --- |
| **Account key** | [**Developers**](https://voxio.in/dashboard/developers) in the dashboard | Create, change and delete every flow on your account, and rotate their keys. |
| **Flow key** | The flow's **Overview** | Start sessions with that one flow, and read its sessions and usage. |

## Use a flow key in the browser

Widgets and browser sessions take the flow key as `flowKey`. Anyone who opens your page can read it, like a public API key for maps or analytics. It can only start conversations with that flow and read its sessions; it can't change the flow.

Pass the flow key when you create a session:

```js
import { createSession } from "voxioagent/client";

const session = createSession({ flowKey: "YOUR_FLOW_KEY" });
```

Replace `YOUR_FLOW_KEY` with your flow key, from the flow's **Overview** in the dashboard.

## Keep the account key on your server

> **Warning: Never put your account key in a web page**
>
> Anyone can read what a page sends, and the account key controls every flow you own.

Store the account key in an environment variable:

macOS / Linux:

```bash
export VOXIO_SECRET_KEY="ACCOUNT_KEY"
```

Windows (PowerShell):

```powershell
$env:VOXIO_SECRET_KEY = "ACCOUNT_KEY"
```

Replace `ACCOUNT_KEY` with your account key, from **Developers**.

Then read it on your server when you create the client:

server.js:

```js
import { Voxio } from "voxioagent/server";

const voxio = new Voxio({ secretKey: process.env.VOXIO_SECRET_KEY, environment: "gpu" });
```

`voxioagent/server` refuses to run in a browser, so the account key can't end up in a page by accident.

## Rotate a key

If a key leaks, replace it. The old key stops working at once, and calls already running carry on until they end.

- To rotate the account key, go to **Developers** and click **Rotate**.
- To rotate a flow key, open the flow's **Overview** and click **Rotate**.

To rotate a flow key from your server, call `rotateKey`:

```js
const { flowKey: newKey } = await voxio.flows.rotateKey("OLD_FLOW_KEY");
```

Replace `OLD_FLOW_KEY` with the key to replace.

Update every page and server that used the old key.

## Accounts

Create accounts at [voxio.in/signup](https://voxio.in/signup) and sign in at [voxio.in/login](https://voxio.in/login). Each account gets its account key when it's created, and flows you make in the dashboard are ready for the voice servers straight away. There's no API for creating accounts or signing in.

## Next steps

- [Server SDK](https://voxio.in/docs/server.md): set up voxioagent/server with your account key.
- [Servers and environments](https://voxio.in/docs/environments.md): choose which Voxio servers your code talks to.