# Getting credentials

> Print the metrics API URL and osk_ API key with openshield key, rotate a key, and understand how the console stores your secrets.
>
> Canonical: https://xdp.network/docs/openshield-xdp/getting-credentials · Updated 2026-08-09

The console authenticates to your agent with an API key. You get the key from the server
itself — it is never generated or displayed in the dashboard.

## Print the metrics API URL and key

On the server, run:

```bash
openshield key
```

This prints the metrics API URL and the API key. Keys start with the `osk_` prefix, which
makes them easy to recognize in configs and logs. Paste both values into the **Add server**
form in the console.

:::warning
Treat the key like a password — anyone holding it can read your server's metrics from any
address in `metrics.whitelist`. Do not commit it to a repository or paste it into tickets
or chat.
:::

## Rotate an API key

If a key leaks or you rotate secrets on a schedule:

1. Rerun `openshield key` on the server to issue a fresh key.
2. In the console, remove the existing server entry and add it again with the new key.

The console does not edit keys in place — remove and re-add is the supported flow.

## How the console stores your key

The console stores API keys server-side. After you save a server, the browser never sees
the key again: dashboard pages only receive proxied, permission-checked responses, so the
secret stays off client machines entirely.

## Next steps

- [Connecting a server to the dashboard](/docs/openshield-xdp/connecting-a-server)
- [Enabling metrics](/docs/openshield-xdp/enabling-metrics)