# Import an exchange API key

Bring an existing exchange HMAC secret into the vault. The secret is sharded in your browser and sent directly to the key store nodes; it never passes through the Orchestrator.

## Before you start

* Confirm the target venue already exists in the vault (see [Venues](/guide/keys/venues)). If not, create it first.
* You need the `import_generate_keys` capability. If the button is absent, ask an admin to grant your group that permission in the Administrative Policy.

## Steps

1. In the sidebar, click **Offchain Keys**.
2. Click **New API Key** (top right).
3. In the **Name** field, enter a descriptive label for the key.
4. Open the **Venue** dropdown and select the exchange this key belongs to. The signing scheme is determined by the venue.
5. For an HMAC venue, two fields appear: **API Key** and **API Secret**. Paste the values from the exchange.
6. (Optional) Set **Environment**, **Expiration date**, and any free-form **Metadata**.
7. Click **Submit API Key**.

A success toast confirms the import. The key appears in the table and is immediately available for signing, subject to your Signing Policy.

![New API Key dialog on the HMAC path with venue, API Key, and a masked API Secret field](/img/guide/keys/import-form.png)
*Importing an exchange key: choose the HMAC venue, paste the exchange API key and secret. The secret is masked, and the browser shards it directly to the Key Stores; it never reaches the Orchestrator.*

## What happens under the hood

When you click **Submit API Key**, the browser calls Sodot's client-side library to split the HMAC secret into cryptographic shares. Each share is encrypted and sent directly to the corresponding key store node over a mutually authenticated channel. The assembled secret never travels over the network.

## Troubleshooting

**The "New API Key" button is absent.** Your user or group does not have the `import_generate_keys` capability. Contact an administrator.

**"Keys imported successfully" appears but the key is not in the table.** Refresh the page. The table may have been cached from a previous load.