> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sabaothcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# API Keys
> Create, use, revoke and delete API keys for the SabaothCloud API
API keys let scripts, CI pipelines and other tools call the SabaothCloud API without your password. Each key belongs to one organization and can do only what your role in that organization allows, limited further by the scopes you choose.
Open **API Keys** in the sidebar.
The table shows each key's **Name**, **Key Prefix**, **Scopes**, when it was **Last Used**, how many requests it has made (**Usage**), when it **Expires** and its **Status**.
Owners, Admins and Developers can create API keys. Viewers can see the list.
## Create an API key
1. Click **Create API Key**.
2. Enter a **Key Name** of 3 to 100 characters that says what the key is for, such as `CI deploy key`.
3. Choose the **Scopes** the key needs. Select **Full Access (\*)** only if the key really needs everything.
4. Leave **Never expire** checked, or uncheck it and enter the number of days until the key expires.
5. Click **Create Key**.
The next screen shows the full key.
The full key is shown only once. Copy it and store it in a secrets manager or your CI provider's secret store before clicking **I've copied my key**. If you lose it, revoke it and create a new one.
The **Key Prefix** is the first 8 characters after `mpg_`. Use it to identify the key in the list and in the audit log.
## Scopes
| Group | Scope | Allows |
| - | - | - |
| **Databases** | `clusters:read` | View services. |
| | `clusters:write` | Create and update services. Includes read. |
| | `clusters:delete` | Delete services. Includes read and write. |
| **Billing** | `billing:read` | View spending caps and billing details. |
| | `billing:write` | Create and update spending caps. Includes read. |
| **Organizations** | `organizations:read` | View organization details. |
| **Full access** | `*` | Everything your role allows. |
Give each key only the scopes it needs, and use a separate key for each tool or pipeline. Then you can revoke one without affecting the others.
## Use an API key
Send the key in the `Authorization` header:
```bash theme={null}
curl https://api.sabaothcloud.com/api/v1/clusters?organization_id=YOUR_ORG_ID \
-H "Authorization: Bearer mpg_YOUR_API_KEY"
```
See the [API reference](/api-reference/introduction) for more.
## Revoke a key
Click **Revoke** next to the key and confirm with **Revoke Key**. The key stops working immediately and moves to **Revoked Keys**. This can't be undone.
## Delete a key
Click **Delete** next to an active or revoked key and confirm. The key is removed from the list. Revoke a key first if you want to keep a record of it.
## Expired keys
A key past its expiry date shows **Expired** and no longer works. Create a new key to replace it.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.