# Lost your key? (/docs/lost-key)



viralquery stores only a **hash** of your API key, never the key itself — so a lost key can't be
re-shown, by anyone. Recovery **reissues**: you prove you own the account's email with a one-time
code, and a **new** key is issued. The old key stops working the moment the new one is issued.

The code — never the key — is what lands in your inbox. The key itself is only ever delivered over
HTTPS, at your terminal.

## Two steps [#two-steps]

```bash
# Point a fresh CLI install at the public API.
viralquery auth --url https://api.viralquery.com

# 1. Request a code (sent to the email you subscribed with)
viralquery recover --email you@example.com

# 2. Enter the 6-digit code at the hidden prompt — issues a NEW key and saves it to ~/.viralquery/config.json
viralquery reissue --email you@example.com
```

Or over raw HTTP (both endpoints are public):

```bash
curl -X POST https://api.viralquery.com/v1/api_keys/recover \
  -H "Content-Type: application/json" -d '{"email": "you@example.com"}'
# → { "sent": true, "message": "If an account exists for that email, a verification code has been sent." }

curl -X POST https://api.viralquery.com/v1/api_keys/reissue \
  -H "Content-Type: application/json" -d '{"email": "you@example.com", "code": "123456"}'
# → { "status": "completed", "apiKey": "sk_viralquery_..." }   (shown once — save it)
```

## Rules [#rules]

* Codes expire in **10 minutes** and work **once**. Requesting a new code invalidates the old one.
* Requests are rate-limited per email (a handful of codes per hour; a bounded number of attempts).
* The response to `recover` is the same whether or not the email has an account.
* Reissuing **rotates** the key: update every place the old key was configured.
* Your email is the one from your Stripe checkout. If you subscribed through an agent and don't
  know the email on file, it's the one on your Stripe receipt.