Each assistant that cannot sign you in gets its own key. You name it. You revoke it without breaking the others.
That is the whole point of keys being rows instead of one secret for the account. One leak should kill one credential.
What you see on /account/keys
Each active key shows:
- A name you chose — required, at most sixty characters, unique among your active keys
- A hint — twelve characters of a generated key (
rl_3f9a…), enough to tell which laptop still has which string. Keys that were never shown in the clear — older configured ones — may have no hint - Created, last used, revoked — last used updates at most once every few minutes, enough to answer "is anything still using this" before you revoke
The full secret is shown once, on the page, when you issue it. A redirect would put it in a URL. After that, only the hash is kept. Matching is exact: wrong case and a trailing space do not work.
/account/key permanently redirects here, so old mail and bookmarks still land.
Issue in the browser, revoke from anywhere
Issuing writes a hash, never the plaintext, and uses a random rl_ key so secret scanners can find the shape.
Your assistant can list keys and revoke one. It cannot issue one. A leaked key that could mint itself a successor would be a different product. Revoking also emails you — housekeeping and a lockout look the same from outside, and the mailbox is the one channel a compromised assistant session does not control.
Closing the account revokes every key.
Ten active keys is the cap. Revoked ones do not count.
Revoking does not reopen cold email
Issuing a key on an account that was still provisional activates it — a keyed account is a real account. Revoking does not undo that. Provisional is what makes a mailbox cold-emailable by strangers. If revoking cleared that, containing a leak would open your inbox to cold email.
An account that signed in through Claude or ChatGPT and never issued a key is already activated. ChatGPT requires developer mode before it exposes the custom-connector setup. The key path is only for clients that configure a connector by URL and headers.
Next to the security essay
How to handle API keys for AI tools is the practice: never paste a key into a chat, one key per integration, ask what possession authorises and how fast you can revoke. This page is the RelayLink product that makes that possible.
Issue a key from your account page, put it only in a connector settings field, and when something looks wrong, revoke that name. Setup covers which clients need a key at all.