> ## Documentation Index > Fetch the complete documentation index at: https://docs.leapter.com/llms.txt > Use this file to discover all available pages before exploring further. # Create and revoke an evaluation key > Give a calling system its own key for one application, and revoke the key when the system no longer calls. You need an evaluation key whenever a new system should call a deployed application, and you revoke it when that system stops calling or the key was seen by someone who should not have it. ## Before you start * The application is deployed to the environment ([Deploy a release and call it](https://docs.leapter.com/rc/user-guide/deploy-and-call.md)). * To create and revoke keys, you hold `key:mint` and `key:revoke` in the environment, for example as an operator. To see the list of keys, you hold `binding:read`, for example as an auditor. [Who may do what](https://docs.leapter.com/rc/user-guide/concepts.md#who-may-do-what) lists the roles. * You can sign in to the Admin UI of the runtime cluster, for example `https://cluster.example.com/runtime-management/ui/`. ## Create a key **1. Open the application** Open the Admin UI and click **Sign in with Leapter**. Choose the environment in the environment list at the bottom of the sidebar. On the **Status** page, click the application's name. The application's page opens. **2. Start a new key** Scroll down to the **Keys** card and click **Create key**. ![The application page of pizza-pricing-calculator-180269. The Keys card says This application has no key in this environment. The Create key button has a green ring.](https://mintcdn.com/leapter/3NthIZmfsFFgUhyn/rc/user-guide/images/admin-keys-create.png?fit=max\&auto=format\&n=3NthIZmfsFFgUhyn\&q=85\&s=5a9f087ce07bff935b083d47a26f47e0) The Keys card with Create key. **3. Name the calling system** In **Used by**, type the system that will hold the key, for example `pizza-shop`. An operator reads this before they revoke a key, to know what stops working. In **Reason**, type why the system needs the key. Click **Create**. ![The dialog Create an evaluation key with Used by pizza-shop and Reason The pizza shop shows prices from this release. The Create button has a green ring.](https://mintcdn.com/leapter/3NthIZmfsFFgUhyn/rc/user-guide/images/admin-keys-create-dialog.png?fit=max\&auto=format\&n=3NthIZmfsFFgUhyn\&q=85\&s=24c7681ca2ee4651550c1eef554f454d) The dialog Create an evaluation key. **4. Copy the key and give it to the system** In **Copy this key now**, the dialog says "Nothing has been copied yet. Done drops this value for good." Click the copy button next to the key. **Copied** appears. Give the key to the calling system, for example as a secret in its configuration. Then click **Done**. The Admin UI never shows the key again. ![The dialog Copy this key now. The key field shows lk\_dev\_ followed by dots. The copy button has a green ring, Copied is shown below the field, and Key id and Used by are listed.](https://mintcdn.com/leapter/3NthIZmfsFFgUhyn/rc/user-guide/images/admin-keys-copy.png?fit=max\&auto=format\&n=3NthIZmfsFFgUhyn\&q=85\&s=99c9c10e76188b8314cab5a0a2505541) The key is shown only once. The new key is in the **Keys** table with the state **Active**. A new key needs up to about a minute before calls with it work. Until then, calls with it get `401 Unauthorized`, and calls to an application that had no key before get `404 page not found`. ## Revoke a key **1. Find the key** On the application's page, find the key in the **Keys** table. **Used by** tells you which system holds it. **2. Revoke it** Click the actions button (**…**) at the end of the key's row and choose **Revoke**. In a narrow window, the table scrolls sideways: scroll it to the right to see the button. In **Revoke this key**, type why in **Reason** and click **Revoke this key**. ![The dialog Revoke this key. It says Nothing is deleted: the key is marked revoked and stays in this list, and pods stop accepting it within about a minute on a default install. Key id and Used by pizza-shop-test are listed, Reason is filled in. The Revoke this key button has a green ring.](https://mintcdn.com/leapter/3NthIZmfsFFgUhyn/rc/user-guide/images/admin-keys-revoke.png?fit=max\&auto=format\&n=3NthIZmfsFFgUhyn\&q=85\&s=d727d3e8086406e14e4d2dbedbe1705e) Revoking marks the key as revoked. Nothing is deleted. **3. Check the result** The dialog changes to **The key is revoked** and shows **Revoked** with the time, and **By** with your principal as `leapter cluster whoami` prints it, for example `oidc:supabase:0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d`. Click **Close**. In the **Keys** table, the key's state is **Revoked**. To give the system access again, create a new key. ## Result The calling system has a key of its own, and you can take it away without touching the keys of other systems. Within about a minute of a revocation, calls with the revoked key get the answer `401 Unauthorized`: ```json theme={null} {"type":"about:blank","title":"Unauthorized","status":401,"detail":"This request was refused. Present a valid evaluation key for this environment and application.","instance":"/runtime/api/v1/playground/pizza-pricing-calculator-180269/models/pizza_pricing/runs"} ``` ## Troubleshooting **After Sign in with Leapter, you are in the Lab and not in the Admin UI.** Open the Admin UI's address again and click **Sign in with Leapter** once more. You are signed in now, so the **Status** page opens. **The Keys card shows no table, but a sentence that starts with "You need the binding:read right".** You may create and revoke keys, but not see the list. Ask an auditor or an admin of the environment to look up a key for you. **The Keys card has no Create key button.** You may see the keys, but not create or revoke them. The card says "You need the key:mint and key:revoke rights". Ask an operator or an admin of the environment. ## What to do next * [Call a release over REST](https://docs.leapter.com/rc/user-guide/call-rest.md): use the key in a request. * [Find a run and read usage](https://docs.leapter.com/rc/user-guide/runs-and-usage.md): see the calls made with your key. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.