For building directly against the API. If you only need to receive events, use
webhooks instead — they are less work and less to secure.
Creating one
API Keys → Create API Key. Give it a name, choose scopes, and optionally an expiry.
The key is shown once, at creation. Copy it then. If you lose it, revoke it and create
another — there is no way to display it again.
Scopes
Grant only what the integration needs:
A read-only integration should hold only the :read scopes. A leaked read key is an
incident; a leaked write key is a much bigger one.
Naming
Name for where it is used, not what it does — “n8n production”, “warehouse sync”,
“staging tests”. When you need to revoke one in a hurry, that is the information you need,
and “API key 3” tells you nothing about what will break.
Revoking
Revoking is immediate and permanent. The list shows status, scopes, prefix, creation date
and last used — that last column is how you find keys nobody needs any more.
A key that has never been used, or has not been used in months, is almost always safe to
revoke. Do it: unused credentials are pure risk.
Expiry
Setting an expiry means a forgotten key stops working on its own rather than living
forever. Worth using for anything temporary — a contractor’s integration, a one-off
migration, a proof of concept.
Developer documentation
Endpoints, authentication and payloads are in the developer guides. 
