# API keys

The **API Keys** page manages the keys that authenticate programmatic access to the platform, such as MCP deployments and tool management. Open it from **Organization settings > Settings > API Keys** in the dashboard.

## Access requirements

<Callout type="info">
  The entire page requires the `org:admin` scope, for both viewing and managing keys. The [default Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) includes this scope, so only Admins can view, create, or revoke API keys. Members cannot open this page.
</Callout>

## Key list

The page lists every key in a table with the columns **Name**, **Key**, **Scopes**, **Created At**, and **Last Accessed At**. The **Key** column shows only the key prefix, not the full token. Each row also includes a revoke action. Use the search field to filter keys by name.

## Creating a key

Click **New API Key** to open the **Create New API Key** dialog. Enter a key name, then pick one option from the scope radio group:

- **Consumer**: query and modify toolsets, read data, and access MCP servers
- **Producer**: everything Consumer allows, plus uploading OpenAPI documents and triggering deployments
- **Chat**: access the chat API
- **Hooks**: send hook events and OTEL logs
- **Agent**: enrollment token for device agents

On create, the dialog shows the full token once with a copy button and the warning "You will not be able to see this token value again". Copy and store the token before closing the dialog.

## Revoking a key

Use the revoke action on a key's row to invalidate it. The confirmation prompt asks for the key by name before revoking. Revoked keys stop authenticating immediately.