Your API key has two parts, the Key ID and the secret. They are displayed together as a single string in the form KeyID.secret, with a full stop between the two parts. Send the whole string, both parts together, whenever you use the key.
The secret is shown only once
The secret is stored in a form that cannot be read back, so it is hidden from you and from us once it has been created. It is displayed a single time, at the moment the key is created, and never again. Copy the whole string at that point and keep it somewhere safe, such as a password manager.
If the secret is lost there is no way to recover it. Delete the key on the API screen and generate a replacement.
How do I check I have the whole key?
A complete key is 57 characters long: a 16-character Key ID, then a full stop, then a 40-character secret. If a key is being rejected, this is the first thing to check, because a key is easy to truncate when copying it.
The Key ID is listed under Account → API so you can always tell your keys apart. The secret is never listed there.
How do I use the key?
The API is at https://api.bitaroo.com.au and uses bearer token authorisation. Add an Authorization header carrying the full key:
Authorization: Bearer KeyID.secret
For example:
curl -H "Authorization: Bearer KeyID.secret" https://api.bitaroo.com.au/v1/balances
The endpoints, their parameters and their responses are documented at api-docs.bitaroo.com.au.
Once your key exists, keeping it safe is the next step. See Managing and securing your API keys.