> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage API keys

> Create, rotate, and revoke scoped API keys for programmatic access.

# Manage API keys

## What does this do for me?

You create an API key to let a script or external service interact with KeylessSSL without signing in through the browser. Each key carries only the scopes you choose.

## Before you begin

You need an owner, admin, or operator role. Read-only members cannot create or change API keys.

## Create a key

1. Open **API Keys**.

2. Select **Create key**.

3. Enter a label to identify the key later.

4. Select one or more scopes for the key:

   * **domains:read** — list and view domains.
   * **domains:write** — add, update, and remove domains.
   * **certs:read** — list and view certificates.
   * **certs:issue** — request certificate issuance and sync provider state.
   * **webhooks:write** — register, update, and delete webhook endpoints.
   * **audit:read** — search the organization audit log.

5. Select **Create**.

The portal shows the new key secret exactly once. Copy it and store it in a secure location, such as a secrets manager or environment variable.

## Use the key

Send the key in the `Authorization: Bearer` header when calling the API:

```
Authorization: Bearer <your-key-secret>
```

The key is tied to your organization and cannot be used to access another organization's resources.

## Rotate a key

1. Open **API Keys**.
2. Select **Rotate** next to the key.
3. The portal shows a new secret. Copy it and update anything that used the old secret.

Rotation replaces the key value immediately. The previous secret stops working.

## Revoke a key

1. Open **API Keys**.
2. Select **Revoke** next to the key.

Revocation is permanent. You cannot restore a revoked key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.