> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withgiga.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Profile & API Keys

> Manage your account and generate API credentials

# Profile & API Keys

The Profile page is where you manage personal details and API credentials.

## Personal information

You can update:

* **Profile photo** — JPG, PNG, GIF, or WebP (max 10 MB)
* **First and last name**
* **Display name** — shown in audit reports and dashboard activity
* **Email** — primary account email (changes require re-verification)

## API keys

API keys authenticate requests to `api.withgiga.ai`. The format is `giga_sk_` followed by 32 hex characters.

### Generating a key

1. Navigate to **Profile → API Keys**
2. Click **Generate New Key**
3. Optionally add a name (e.g., "CI pipeline", "Production backend")
4. Copy the key immediately — it's shown only once

<Warning>
  After leaving the page, the secret cannot be retrieved. If you lose it, revoke the key and generate a new one.
</Warning>

### Using a key

Pass it in the `Authorization` header on every API request:

```http theme={null}
Authorization: Bearer giga_sk_YOUR_KEY
```

See the [API Authentication reference](/api-reference/authentication) for full details.

### Listing and managing keys

The Profile page shows all your active keys with:

* **Name** — label you assigned
* **Created** — when the key was generated
* **Last used** — most recent successful authentication
* **Revoke** — immediately invalidates the key

### Rotating keys

To rotate without downtime:

1. Generate a new key
2. Update your applications to use it
3. Verify the new key is working
4. Revoke the old key

## Security

* Keys are masked in the dashboard after creation (shown only at generation time)
* Revoked keys are invalidated immediately — in-flight requests fail with `401`
* Failed authentication attempts are logged and rate-limited
* Activity using each key is auditable via **Settings → Activity Log**

<Warning>
  Treat API keys like passwords. Never commit them to source control or expose them in client-side code.
</Warning>