API keys
{/* Clerk-managed API Keys UI component */}
)
}
```
This version gives you full control over where API Keys appear in your dashboard while Clerk handles security and key management.
## Creating protected backend routes
With key generation enabled, the next step is to allow your API to accept API Keys alongside normal user session tokens. Clerk makes this extremely simple with a single configuration change.
### Using multi-token verification
In server-side functions and API routes, Clerk's [`auth()`](/docs/reference/nextjs/app-router/auth) helper can accept more than one token type.
In our demo app, we've configured our `/api/agents/route.ts` file to accept both session tokens and API Keys.
Below is a simplified example:
```tsx {{ mark: [1, [5, 7]], filename: 'app/api/agents/route.ts' }}
import { auth } from '@clerk/nextjs'
export async function GET() {
// Needs to have the `acceptsToken: 'api_key'` or it will only accept session tokens
const res = await auth({
acceptsToken: ['session_token', 'api_key'],
})
if (!res.isAuthenticated) {
return new Response('Unauthorized', { status: 401 })
}
if (!res.orgId) {
return new Response('Unauthorized: please use a valid org key', { status: 401 })
}
// Continue handling request...
}
```
This line tells Clerk to accept:
- Browser-based user sessions (*from logged-in users*)
- API Keys (*passed as a Bearer token in request headers*)
```tsx
acceptsToken: ['session_token', 'api_key']
```
Clerk automatically extracts and verifies the token, determines the organization, and ensures the key has not been revoked.
### Rejecting unauthenticated or cross-org access
Because Clerk includes `orgId` directly in the token, your backend logic becomes extremely straightforward:
- If no `orgId` → reject
- If `orgId` does not match the requested resource → reject
- Otherwise → process the request
This ensures strong multi-tenant isolation and prevents customers from ever accessing resources outside their organization.
## Testing your API Keys
Now that API Keys are enabled and visible in your application’s dashboard, it’s time to test them against real API endpoints in the demo app.
You can use cURL or tools like [Insomnia](https://insomnia.rest/) or [Postman](https://www.postman.com/) to test your API Keys.
Go ahead and create an API Key on the `/dashboard/settings/api-keys` page using the `