# Account & Billing

Manage your Spice.ai account, API keys, orgs, and billing.

## Signing Up

Spice.ai Cloud uses **GitHub for authentication**. To create an account:

1. Go to [spice.ai](https://spice.ai/).
2. Click **Continue with GitHub** and authorize the Spice.ai GitHub App.
3. Spice creates a personal org for you.

See the full [Getting Started guide](https://spice.ai/docs/cloud/getting-started/get-started) for a step-by-step walkthrough.

## API Keys

Each Spice.ai project has **two API keys** that authenticate requests to the data and AI APIs.

### Where to find your API keys

In the [Portal](https://spice.ai/), open your project and go to **Settings** > **API Keys**.

### How API keys are used

| API | Authentication |
| - | - |
| [SQL HTTP API](https://spice.ai/docs/cloud/api/sql-query/http-api) | `X-API-Key` header |
| [Arrow Flight API](https://spice.ai/docs/cloud/api/sql-query/apache-arrow-flight-api) | Password in handshake |
| [LLM API](https://spice.ai/docs/cloud/api/openai-api) | `X-API-Key` header |
| [Search API](https://spice.ai/docs/cloud/api/search) | `X-API-Key` header |
| [SDKs](https://spice.ai/docs/sdks/python-sdk) | Client configuration |

### Rotating API keys

Each project has two keys to support **zero-downtime rotation**:

1. Regenerate Key 2 (while clients use Key 1).
2. Update all clients to use Key 2.
3. Regenerate Key 1.

> **Warning**
>
> Regenerating a key **immediately invalidates** the old key. Ensure all clients are updated before regenerating.

API keys can also be managed via the [Management API](https://spice.ai/docs/cloud/api/management).

## Personal Access Tokens

The [Management API](https://spice.ai/docs/cloud/api/management) uses **personal access tokens** (not project API keys) for authentication. Generate tokens in the Portal under [Settings > Personal Access Tokens](https://spice.ai/docs/cloud/portal/profile/personal-access-tokens).

## Orgs

Orgs are the primary unit for managing teams, projects, billing, and access.

### Personal org

Every user automatically receives a **personal org** on signup. This is a single-member org tied to your account.

### Team orgs

Team orgs allow multiple members to collaborate on shared projects. To create one:

1. In the Portal, go to **Organizations** > **Create Organization**.
2. Connect a **GitHub organization** to link team membership.

### Managing members

Org admins can add members by:

- **Spice username**
- **GitHub username** (requires the user to have a public email on their GitHub profile)
- **Email invitation**

To remove a member, go to your org's **Settings** > **Members**.

See [Orgs](https://spice.ai/docs/cloud/portal/organizations) for full details.

## Plans & Billing

### Community Plan (Free)

The free [Community Plan](https://spice.ai/docs/cloud/pricing/community) includes:

- One project per org.
- Access to all building blocks (data connectors, AI gateway, search, etc.).
- **Auto-pause**: Projects without API requests for 7 days are automatically paused. Paused projects can be restored anytime in the Portal.

### Paid Plans

[Paid plans](https://spice.ai/docs/cloud/pricing/plans) provide:

- Higher request and query limits.
- No auto-pause.
- Service-level guarantees.
- Priority support with SLA.
- SOC 2 Type II report access.

See [Pricing](https://spice.ai/pricing/cloud) for current plan details.

## Secrets

Project secrets store sensitive configuration values (API keys for data sources, model provider credentials, etc.).

### Key behaviors

- Secrets are **project-scoped** and encrypted.
- Values are **write-only**. You cannot retrieve a value after you save it.
- To change a value: delete the secret and recreate it.
- Secret changes require a **new deployment** to take effect.
- Reference secrets in your Spicepod with: `${secrets:SECRET_NAME}`.

See [Secrets](https://spice.ai/docs/cloud/portal/apps/secrets) for details.

## Security & Compliance

Spice.ai Cloud is **SOC 2 Type II** compliant. Key security measures include:

- Authentication and authorization with RBAC.
- MFA enforcement.
- Encryption in transit (TLS 1.2+) and at rest.
- Auditable access logs.
- Secure code scanning and third-party audits.

See [Security](https://spice.ai/security) for the full security overview. Enterprise plan customers can request the SOC 2 report.