API keys
Creating, scoping and revoking keys.
API keys let an agent or a script authenticate. Anyone can create their own, including viewers.
Creating one
Settings → API keys → Create. Give it a name that says where it will live — "laptop, Claude Code" beats "key 2" when you are deciding what to revoke six months from now.
Copy it immediately. It is displayed once and never again.
What a key can do
A key is bounded by two things, and the tighter one applies:
- Its scopes — read, write, or admin
- Its creator's current role
The second is the useful property: a key can never do more than the person who made it can do today. Demote someone and every key they made drops with them, with no cleanup to run.
Revoking
Settings → API keys → Revoke. Takes effect within seconds.
You only see and manage your own keys. Administrators see the organization's.
Good practice
- One key per place it is used, so revoking one does not break the others
- Name them after their location
- Revoke rather than sharing an existing key
- Never commit one to a repository
A key carries its creator's access to your company's content. Treat it like a password. Where a client supports OAuth, prefer that — there is no long-lived secret to leak.