> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sintropix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Get a Sintropix API Key for Agents and Integrations
> Create a Sintropix API key from Settings, pass it in the x-api-key header, and understand the scope, rate limits, and rotation rules that apply to programmatic access.
Sintropix API keys let agents and integrations authenticate as a User without a browser session. Each key is a long-lived credential passed in the `x-api-key` header, inherits the owning User's Role and Memberships, and is rate-limited to 25,000 requests per hour.
Keys are created in the Sintropix web app at [app.sintropix.com](https://app.sintropix.com). The whole trip takes under a minute.
Sign in as the User the key should act on behalf of. The key inherits that User's Role and per-Entity Memberships, so choose a User with the access the integration actually needs.
Click your name at the bottom of the left sidebar and choose **Ajustes**.
Settings opens on the **Empresa** page. In the Configuración list on the left, click **Claves de API**.
The page lists every key you own with its name, prefix, creation date, expiry, and last use. Keys can be revoked from the trash icon on each row.
Click **Crear clave**. Give the key a descriptive name (for example `erwin-agent` or `reconciliation-bot`) so you can identify it later in the key list and the audit trail, then click **Crear clave** in the dialog.
The key is shown once. Copy it with the button next to the field and store it in your secrets manager before clicking **Listo**. Sintropix does not display the secret again after this screen; if you lose it, revoke the key and create a new one.
Send the key in the `x-api-key` header on every request:
```bash theme={"system"}
curl https://api.sintropix.com/api/entities \
-H "x-api-key: $SINTROPIX_API_KEY"
```
Every mutating request (`POST`, `PUT`, `PATCH`, `DELETE`) made with a key must also send an `x-audit-actor` header naming the software that is acting. The value is recorded verbatim in the [audit trail](/api-reference/audit-trail); omitting it returns `400`.
```bash theme={"system"}
curl -X POST https://api.sintropix.com/api/entities/$ENTITY_ID/partners \
-H "x-api-key: $SINTROPIX_API_KEY" \
-H "x-audit-actor: my-agent" \
-H "Content-Type: application/json" \
-d '{
"id": "0b6c0f2e-5a4d-4e8f-b1c3-7d9e2a4f6c88",
"name": "Servicios Cloud SpA",
"type": "vendor",
"country": "CL",
"taxId": "76123456-0"
}'
```
Requests to `/api/auth/*` are rejected when they carry `x-api-key`, so keys cannot be used to mint further keys or manage Users.
## Scope and Permissions
* A key authenticates as its owning User with that User's global Role and per-Entity Memberships.
* Business routes are scoped by Entity (`/api/entities/{entityId}/...`). A key can only access Entities the owning User is a member of.
## Rate Limits
Each key is limited to **25,000 requests per hour** on a sliding window. Requests over the limit return `429 Too Many Requests`; back off and retry after the window resets.
## Rotation and Revocation
* Rotate keys on a schedule and whenever a team member with access leaves.
* Revoke a key immediately from **Ajustes → Claves de API** if you suspect it has leaked. Revocation takes effect on the next request.
* Every action taken with a key is recorded in the [audit trail](/api-reference/audit-trail) under the owning User, so leaked-key activity is traceable.
Base URL, request and response format, error envelope, and per-Entity scoping.