# Use and rotate Access Keys

Protect a Tunnel with least-privilege keys and a safe rotation workflow.

- Category: Security
- Reading time: 7 分钟
- Locale: en

## Default policyPersistent Tunnels use key mode by default. Requests must include an Access Key.
```
curl -H "x-anureo-access-key: anr_pk_…" https://your-tunnel.example/
```## Rotation workflowCreate a new Access Key.Switch callers to the new key.Revoke the old key after verification.
> Do not log plaintext keys: The key is shown once. Store it in a Secret Manager.