> ## Documentation Index
> Fetch the complete documentation index at: https://docs.linkiasoft.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Creating scoped keys for programmatic access, and revoking them safely.

For building directly against the API. If you only need to *receive* events, use
[webhooks](/help/integrations/webhooks) instead — they are less work and less to secure.

## Creating one

**API Keys → Create API Key.** Give it a name, choose scopes, and optionally an expiry.

<Warning>
  The key is shown **once**, at creation. Copy it then. If you lose it, revoke it and create
  another — there is no way to display it again.
</Warning>

## Scopes

Grant only what the integration needs:

| Scope                 | Allows                          |
| --------------------- | ------------------------------- |
| `conversations:read`  | Read conversations              |
| `conversations:write` | Create and modify conversations |
| `messages:read`       | Read messages                   |
| `messages:write`      | Send messages                   |
| `channels:read`       | List channels                   |
| `channels:write`      | Modify channels                 |

A read-only integration should hold only the `:read` scopes. A leaked read key is an
incident; a leaked write key is a much bigger one.

## Naming

Name for **where it is used**, not what it does — "n8n production", "warehouse sync",
"staging tests". When you need to revoke one in a hurry, that is the information you need,
and "API key 3" tells you nothing about what will break.

## Revoking

Revoking is immediate and permanent. The list shows status, scopes, prefix, creation date
and **last used** — that last column is how you find keys nobody needs any more.

A key that has never been used, or has not been used in months, is almost always safe to
revoke. Do it: unused credentials are pure risk.

## Expiry

Setting an expiry means a forgotten key stops working on its own rather than living
forever. Worth using for anything temporary — a contractor's integration, a one-off
migration, a proof of concept.

## Developer documentation

Endpoints, authentication and payloads are in the [developer guides](/introduction).