# Authentication & keys
Sign in at [app.keln.ai](https://app.keln.ai) with Google, GitHub, or email and password.
## API keys
- Header: `Authorization: Bearer sk-keln-…`
- You create keys in the portal under **Keys**. Keln shows each key once and stores only a hash.
Revocation is immediate.
- Creating a key requires a verified email address.
- Keys belong to a workspace, your personal one or a [team](teams.md). Keln bills usage and spend
to the key's workspace and attributes them per key. Each key records who created it.
## Per-key budgets
Cap any key's spend with a USD budget that resets daily, weekly, or monthly, using the
**Spend limit** control on the key's row (owner or admin in teams). A key over its budget returns
`402` with `"API key budget exceeded for the current period"` until the period resets or you raise
the budget. Changes take effect within seconds.
## Workspace balance
Workspaces are prepaid. At zero balance, requests return `402 "insufficient balance"`, a
different message from a key that has spent its budget. Balance, top-ups, saved cards, and auto
top-up are on the [Billing](billing.md) page. Keln emails you when the balance runs low and when
it runs out.
## Good practice
- Use one key per app or environment, so attribution and revocation stay per app.
- Set a budget on every key you deploy.
- Rotate by creating the replacement first, deploying it, then revoking the old key.
Authentication & keys
Sign in at app.keln.ai with Google, GitHub, or email and password.
API keys
Header: Authorization: Bearer sk-keln-…
You create keys in the portal under Keys. Keln shows each key once and stores only a hash.
Revocation is immediate.
Creating a key requires a verified email address.
Keys belong to a workspace, your personal one or a team. Keln bills usage and spend
to the key's workspace and attributes them per key. Each key records who created it.
Per-key budgets
Cap any key's spend with a USD budget that resets daily, weekly, or monthly, using the
Spend limit control on the key's row (owner or admin in teams). A key over its budget returns
402 with "API key budget exceeded for the current period" until the period resets or you raise
the budget. Changes take effect within seconds.
Workspace balance
Workspaces are prepaid. At zero balance, requests return 402 "insufficient balance", a
different message from a key that has spent its budget. Balance, top-ups, saved cards, and auto
top-up are on the Billing page. Keln emails you when the balance runs low and when
it runs out.
Good practice
Use one key per app or environment, so attribution and revocation stay per app.
Set a budget on every key you deploy.
Rotate by creating the replacement first, deploying it, then revoking the old key.