> ## Documentation Index
> Fetch the complete documentation index at: https://docs.meshagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage project-scoped credentials for automation and backend services.

API keys are project-scoped credentials for backend services, CI, and automation that call MeshAgent APIs. Use them when a service or script needs to act on behalf of the project.

Do not put them in end-user clients or use them as the user's sign-in credential. People using MeshAgent Studio or Powerboards sign in with MeshAgent directly. If you are building your own app on top of MeshAgent, use the API key on your backend, create an [OAuth client](./oauth) for user sign-in when needed, and issue [participant tokens](../rest_api/participant_tokens) to the client.

## Create a key

You can create API keys in [MeshAgent Studio](../interfaces/meshagent_studio) or with the CLI. The secret value is only shown once.

### MeshAgent Studio

1. Open your project in MeshAgent Studio.
2. Go to **Access Management**.
3. Open a service account's **API Keys** menu.
4. Create a new key and save the secret value.

### MeshAgent CLI

If you want to create a key from the terminal and activate it for local CLI use at the same time:

```bash theme={null}
meshagent service-account api-key create my-service-key \
  --service-account default \
  --description "Used by the deploy pipeline" \
  --activate
```

`--activate` saves the new key in your local CLI project settings so commands that use an API key can pick it up automatically.

To activate an existing key later, use:

```bash theme={null}
meshagent service-account api-key activate <key-value>
```

## Rotate or remove keys

List the keys for a service account in the active project:

```bash theme={null}
meshagent service-account api-key list --service-account default
```

Print the locally activated key id, or emit it as a shell export snippet:

```bash theme={null}
meshagent service-account api-key get
meshagent service-account api-key env
```

Delete a key you no longer need:

```bash theme={null}
meshagent service-account api-key delete <key-id> --service-account default
```

## Best practices

* **Rotate regularly** and delete unused keys.
* **Store keys securely** in a secret manager or CI vault.
* **Avoid sharing keys** across multiple services.

## Related docs

* [OAuth Clients](./oauth)
* [REST API Overview](../rest_api/overview)