--- title: "API keys in Orbit Connect" description: "Create, rotate, re-role and delete your carrier's API keys in Orbit Connect, so your TMS or telematics can read and update your tours." url: "https://support.pr-2.orbit.do/en/advanced-features/api-keys-in-connect" locale: "en" apps: ["connect"] lastReviewed: "2026-10-23" --- # API keys in Orbit Connect Create, rotate, re-role and delete your carrier's API keys in Orbit Connect, so your TMS or telematics can read and update your tours. An API key lets your own systems work with Orbit without a person signing in: your TMS reads the tours your clients give you, your telematics reports where they are. As a carrier administrator you create and manage your carrier's keys yourself in Orbit Connect under **API-Keys**. **Key highlights:** * **Your carrier's keys only:** a key belongs to your carrier and sees only your carrier's tours. You see and change only your own carrier's keys. * **Shown once:** Orbit stores only a fingerprint of a key. You see the key itself once, right after you create or rotate it. After that the list shows only its beginning and its last four characters, for example `orb_car_live_…7Fq2`. * **A role per key:** each key holds a role, which you choose when you create it and can change later. * **Rotation without downtime:** rotating creates a new key, and the old one keeps working for an overlap you choose. ## Who manages keys **API-Keys** appears in the navigation of Orbit Connect, below **Vehicles**, for carrier administrators. Other users of your carrier do not see it. Your client, the company that gives you the tours, can manage your keys too, in Orbit MissionControl. ## The list Each row shows the key's **Name**, its **Role**, the end of the **Key**, when it was **Last used** and when it **Expires**. A row can carry these markers: | Marker | Meaning | | --------------------- | --------------------------------------------------- | | **In 5 days** | The key expires in fewer than seven days. | | **Expires on 20.10.** | The old key of a rotation, working until that date. | | **Expired** | The key no longer works. The row is greyed out. | **Last used** is updated at most every 15 minutes, so a key in constant use can show a time a few minutes ago. ## Create a key 1. In Orbit Connect, open **API-Keys** in the navigation. 2. Select **Create API-Key**. The card **New API-Key** opens above the list. 3. Enter a **Name** that tells you where the key is used, for example `Telematics Northern Light`. 4. Choose the **Role** and when the key **Expires**: **Never**, **In 30 days**, **In 90 days** or **In 365 days**. 5. Select **Create**. A dialog shows the key. Copy it with **Copy** and store it where your system can read it, then select **I have saved the key**. > **Warning:** The dialog is the only place the key is shown. If you close it without saving the key, delete the key and create a new one. ![The API-Keys page in Orbit Connect with three keys of the carrier, the old key of a rotation greyed out with its expiry date](https://support.pr-2.orbit.do/images/api-keys-in-connect/connect-keys.png) *The API keys of a carrier in Orbit Connect: the new key of a rotation above the old one, which still works until its expiry date.* ## Roles The role decides what a key may do. **Role** offers: * **Carrier API Key Full Access**: everything your carrier may do with its tours, drivers and vehicles. * **Carrier API Key Read Only**: reads the same data without changing it. * Roles your client created for carrier keys, under **Own roles**. You cannot create roles yourself; ask your client when you need one. To change a key's role, open the row's **…** menu and select **Change role …**. The new role applies within a minute. ## Rotate a key Rotating replaces a key with a new one that has the same name and role. Use it when a key may have been seen by someone else, or regularly as a precaution. 1. Open the row's **…** menu and select **Rotate …**. 2. Choose when the old key expires: **At once**, **After 24 hours** or **After 7 days (recommended)**. 3. Select **Rotate**. The new key is shown once, as after a create. Enter it in your system before the old one expires. A key can be rotated once; to replace it again, rotate the new key. An expired key cannot be rotated. ## Delete a key Open the row's **…** menu, select **Delete …** and confirm with **Delete**. Systems using the key lose access within a minute. A deleted key cannot be restored. ## History Select **History** in a row's **…** menu to see what happened to a key: when it was created, rotated, re-roled or deleted, and by whom. The history of a rotated key also lists the keys it replaced. ## Example Nordlicht Spedition in Hamburg drives tours for a logistics company. Its administrator Julia creates a key named `Telematics` with **Carrier API Key Full Access** for the telematics system and a second key with **Carrier API Key Read Only** for a planning spreadsheet in Bremen. When the telematics provider changes, Julia rotates the first key with an overlap of 24 hours and enters the new key in the new system. ## Technical details Carrier keys work with the Carrier API. The page links its reference under **Go to the Carrier API**. Send the key in the `x-api-key` header. **Q: Can I see a key again after closing the dialog?** No. Orbit stores only a fingerprint of each key, so nobody can show it again. Rotate the key or create a new one. **Q: Can I manage the keys of another carrier?** No. You see and change only the keys of your own carrier, and every key you create belongs to your carrier. **Q: What happens to a key when the person who created it leaves?** Nothing. A key belongs to your carrier, not to a person, and keeps working. **Q: Why does a key still work right after I deleted it or changed its role?** Orbit remembers a key for up to a minute. After that every request uses the new state. Related: [API keys](https://support.pr-2.orbit.do/en/advanced-features/api-keys)