# Agents and keys There are two kinds of credential; don't mix them up. | | API key | Agent key | | --- | --- | --- | | Purpose | The gateway authenticating to the control plane | Naming which agent's policy to resolve | | Format | `ag_live_…` (Bearer) | Generated when registering an agent | | Where | Settings → API Keys | Agents page | | How it is sent | `Authorization: Bearer …` | `X-Agent-Key` header or `agentKey` query parameter | ## Pausing an agent For a paused agent `/api/gateway/resolve` returns `403`: "agent is paused". This stops the gateway from resolving a policy for that agent and can serve as an emergency stop. > **Secrecy**: An API key is shown in full only once, at creation. Store it in a secure secret manager and never commit it to a repository.