---
title: "API keys"
description: "Create, limit, rotate and revoke the workspace API keys that authenticate the REST API, the CLI and MCP, and review personal connections."
canonical: "https://lookio.app/docs/platform/api-keys"
updated: "2026-10-25"
---

# API keys

An API key is a credential for your workspace, for a script, an automation or a server. It belongs to the workspace rather than to a person, so it keeps working when someone leaves.

Open **Developer tools** in the sidebar, then the **API** tab. Only admins can create, rotate and revoke keys. Members see the page read-only.

## Create a key

Choose **Create key** and name it. **Full access** is selected by default, including scopes for capabilities that are not active yet. Choose a narrower preset or adjust the scopes before creating the key.

| Preset            | Scopes                                                                                                                 |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Ask questions** | `account:read`, `assistants:read`, `query`                                                                             |
| **Read only**     | `account:read`, `usage:read`, `resources:read`, `assistants:read`                                                      |
| **Editor**        | The read-only scopes, plus `resources:write`, `assistants:write` and `query`. It deletes no resource and no assistant. |
| **Full access**   | Every scope, including those that are not active yet.                                                                  |

Open **Advanced** to tick scopes one by one. The meaning of each scope is on the [Authentication](/docs/api/authentication#scopes) page.

For an SDK key that only asks assistants questions, use **Ask questions** and limit it to the assistants your product needs.

You can also:

- **Set an expiry**: 30, 90 or 365 days, or none.
- **Limit the key to some assistants.** A key limited this way can only use those, and cannot create new ones.

A key looks like `sk_live_...`. Lookio shows it once, then stores only a hash. If you lose it, revoke it and create another. A workspace can hold up to 10 active keys.

> **Warning: Keep keys out of browsers and URLs**
>
> A key spends your credits and reads your knowledge. Never put one in front-end code, a URL or a query string. Call the API from a server. The API does not allow cross-origin browser requests for this reason.

## Rotate and revoke

- **Rotate** creates a new key and stops the old one right away. Copy the new key, then update whatever used the old one.
- **Revoke** stops a key at once. It cannot be undone.
- **Rename** changes the label only. The key does not change.

## Personal connections

When someone signs in from the CLI or connects an AI client, Lookio creates a connection tied to that person. The **Connections** section lists each one with who approved it, what it may do and when it was last used. An admin can revoke any connection. A revoked connection loses access immediately, and its owner can connect again.

A connection acts with its owner's permissions. See [Members and permissions](/docs/platform/members-and-permissions#permissions-and-the-api).

Connection tokens are valid for 30 days and renew with a refresh token that lasts 90 days, which the CLI handles for you.

## API keys or connections

| Use              | For                                                                                                |
| ---------------- | -------------------------------------------------------------------------------------------------- |
| An **API key**   | A job, an automation or a backend with no person behind it.                                        |
| A **connection** | A person's CLI or AI client. It carries their identity and permissions, and keeps their own chats. |