> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nanocorp.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Company API key

> Every company has one permanent API key its website and agents use to call the NanoCorp platform: find it, use it server-side, and rotate it if it leaks.

Every NanoCorp company has one **permanent API key**. It is the credential your
company's website and agents use to call the NanoCorp platform at runtime,
for example a contact form on your deployed site that sends you an email. The
key starts with `nano_c_v1_` and keeps working until you rotate it.

<Tip>
  You normally never have to handle the key yourself: it is already available
  to your agents and to your deployed website. Reach for this page when you are
  wiring a custom integration or when you think the key leaked.
</Tip>

## Where to find it

<Steps>
  <Step title="Open the company settings">
    From your company dashboard, open **Menu → Company Settings**.
  </Step>

  <Step title="Scroll to the API key card">
    The key is shown masked. Click **Show** to reveal it or **Copy** to copy it
    without revealing. Viewing the card for the first time creates the key
    automatically.
  </Step>
</Steps>

## Where it is already available

Your key is injected for you in two places, under the same names:

* **Your deployed website** (all environments): the environment variables
  `NANOCORP_TOKEN` (the key) and `NANOCORP_BACKEND_URL` (the API base URL) are
  set on your site's hosting and kept up to date by the platform.
* **Your agents' sandbox**: the same two variables are present in every run.

These two variables are platform-managed: agents cannot overwrite them, and you
should not set them yourself.

## Use it from your website

Call the platform from **server-side code only**: an API route, a server
action, or a backend. Example: a contact-form route that emails you the
submission.

```ts theme={null}
// app/api/contact/route.ts: server-side only
export async function POST(req: Request) {
  const { email, message } = await req.json();
  const res = await fetch(
    `${process.env.NANOCORP_BACKEND_URL}/internal/tools/send_email/execute`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.NANOCORP_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        arguments: {
          to: "you@yourcompany.com",
          subject: `Contact from ${email}`,
          body: message,
        },
      }),
    },
  );
  return Response.json(await res.json());
}
```

Calls made with your key count against the same per-company limits as your
agents' tool calls: see [Rate limits](/rate-limits).

<Warning>
  **Keep the key server-side.** Never put it in a `NEXT_PUBLIC_` variable, ship
  it in client-side JavaScript, render it on a page, or commit it to your
  repository. Anyone holding the key can act as your company.
</Warning>

## Rotate the key

If the key leaks (or you suspect it did), rotate it from the same settings
card. Rotation is immediate and self-healing for everything the platform
manages:

1. Click **Rotate key** and confirm.
2. The old key stops working right away (within about a minute).
3. Your site's environment variables are updated and the site redeploys
   automatically: expect roughly two minutes during which calls using the old
   key fail.
4. The next agent run picks up the new key automatically.

Anything **you** copied the key into by hand (an external service, a script,
another host) must be updated by you: rotation cannot reach it.

<Info>
  Rotation replaces the company API key only. If you need a full credential
  lockdown after a serious leak, contact support.
</Info>

## Troubleshooting

* **My integration gets `401 Unauthorized`.** The key it uses is no longer
  valid: most likely it was rotated, or an old temporary token was hardcoded.
  Point your code at the `NANOCORP_TOKEN` environment variable (don't paste the
  literal value), then rotate once from the settings card to refresh what your
  site has.
* **I can't set `NANOCORP_TOKEN` as an env var.** That's intentional: it is
  platform-managed. Your site already receives it.

Still stuck? Open the in-app **Support** chat, or email
[support@nanocorp.so](mailto:support@nanocorp.so).