# Ingest keys

> One key for each place that sends telemetry to your Grafana.

**Ingest keys** in the portal's menu lists your keys. Each place that sends to
your Grafana, such as a server running Grafana Alloy, has a key of its own,
with its own username: your Grafana's ID, a hyphen and the key's ID, such as
`c-acme-gmbh-k3x9z2`.

A key lets its sender write to your Grafana and nothing else. **A key cannot
read your data.**

Everyone in your organization sees the list: each key's name, username, the
day it was made and its state. Owners and admins create and change keys;
members and viewers ask one of them.

Some Grafanas have one login instead of keys. Owners and admins see it on the
portal's Connect page.

## Create a key

Press **Create key** and name it for where it sends from, such as
`Production Alloy`. You then see its username and password **once**, with the
lines Alloy needs. Store the password in your secret manager, tick **I have
stored the password** and press **Done**. We cannot show it again. If you lose
it, replace the key.

A new key works within about a minute, once your Grafana has taken it. Until
then its state is **Applying…**.

A Grafana has at most five keys, disabled ones included.

## Change a key

Each row has buttons for owners and admins:

- **Replace…** makes a new key with the same name beside the old one. Put the
  new username and password in your senders and restart them, watch the
  portal's Connect page to see your signals keep arriving, then disable the
  old key. The old key works until you do. Replace works only on an active
  key, and needs a free place among the five.
- **Rotate now…** gives the key a new password at once. Senders using the old
  one are refused within about a minute, and what they send meanwhile is lost.
  You type the key's name to confirm. Use it if a password has leaked;
  otherwise replace the key.
- **Disable…** refuses the key within about a minute. You can **Enable** it
  again, or **Delete…** it to make room for another.

A key that Telopi disabled shows our reason and can only be deleted.

While a new password is on screen, the other buttons are off, so you cannot
lose a password you have not stored.

To send with a key, see [Connect your systems](https://docs.telopi.com/connect).