# Credentials and keys

01Spatial separates who is calling from which resource is targeted.

| Credential | Purpose | Location |
| --- | --- | --- |
| **API Key** | Identifies the API user and its permissions. | Portal profile. |
| **Map Key** | Encrypted handle for one map. | Ready map card. |
| **Project Key** | Targets all maps in a Project. | Project information in Spatial Maps. |
| **Login token** | Browser session for Portal management. | Managed by Portal; never copy it into a client. |

Use `api_key + map_key` for a specific map or `api_key + project_key` for Project-wide localization; never send both targets. The API Key must be authorized for the resource.

Keep keys out of public repositories, logs, analytics, screenshots, and ordinary URLs. Use separate environment keys. Regenerating an API Key invalidates the previous value immediately, so inventory and roll out every dependent client before rotation. Map transfer preserves the Map Key, but the accessing API Key must belong to the new owner.