# Migrate from a legacy API key to an OAuth API key

There are two ways to authenticate API requests via Redox: 

- legacy API keys 
- (_Recommended_) OAuth API keys

[Learn more about authenticating and sending data](/basics/data-exchange-with-redox/authenticating-and-sending-data-via-redox).

If you’re currently using legacy API keys but would like to migrate to OAuth API keys, follow the instructions below. This migration can be performed with zero downtime. 

## Prerequisites

- A user must be assigned to an <u>**engineer role**</u> to create or authenticate API keys. [Learn about user roles](/basics/managing-access-for-your-redox-organization/what-are-user-roles).
- Log into the same environment (development / staging / production) where your legacy API key exists. 

## Step 1: Create an OAuth API key

1. Log in to the Redox dashboard.
2. Select the correct **environment** (i.e., where your legacy API key exists) from the drop-down field on the top left. 
3. [Follow the steps for creating a new OAuth API key](https://docs.redoxengine.com/permalink/0CKpMIghEgSam9nJuzyXe/#provide-your-public-key-to-redox). 

## Step 2: Update your code

1. Update your application to authenticate using the new OAuth API key. 
2. If you have more than one source, include the `Redox-Source-Id` header in your API requests. 
You can find the source ID on the <u>Developer</u> \> <u>Sources</u> tab. [Learn more about managing source details](/basics/data-exchange-with-redox/Managing-source-details-in-outgoing-requests).
3. Confirm that your outgoing requests are succeeding with the new API key. 

## Step 3: Rotate your legacy API key secret

> **Don’t delete your old key**
>
> The only way to delete a legacy API key is to delete its associated source. However, you shouldn’t delete a source since it’s likely tied to other backend routing configurations and would require Redoxer support. 
>
> All you need to do is rotate the secret of the old legacy API key. This prevents the old authentication method from being used.

1. Once you fully migrate your application to the new OAuth API key, rotate the legacy API key’s secret by [generating a new secret value](/how-to-use-redox/manage-your-redox-setup/authenticate-a-legacy-api-key). 
2. You can keep both your legacy API keys and OAuth API keys in your system without causing conflicts.