Creating a Key
Name the key
Give it a descriptive name that identifies its purpose. Examples:
cursor-dev, ci-pipeline, staging-gateway.Select scopes
Choose a preset scope profile — workspace, organization, or read-only — or build a custom scope set.
Key Properties
Every API key has the following properties:| Property | Description |
|---|---|
| Name | Human-readable label you assigned at creation |
| Prefix | Visible identifier (e.g., tk_live_a1b2...) used for recognition without exposing the full key |
| Status | active, disabled, or revoked |
| Scopes | Granular permissions attached to this key |
| Created by | Which team member created the key |
| Last used | Timestamp of the most recent API call made with this key |
Permission Scopes
Scopes are granular. You can combine them to build exactly the access profile you need.Full scope list
Full scope list
Organization
organization.read— View organization detailsorganization.settings— Modify organization settingsorganization.delete— Delete the organizationorganization.transfer— Transfer ownership
members.read— View team membersmembers.invite— Invite new membersmembers.remove— Remove membersmembers.role_change— Change member rolesmembers.suspend— Suspend member accounts
api_keys.read— View API keysapi_keys.create— Create new keysapi_keys.revoke— Revoke existing keysapi_keys.manage_all— Manage keys created by other members
policies.read— View policiespolicies.create— Create new policiespolicies.edit— Edit existing policiespolicies.delete— Delete policies
fleet.read— View gateway instancesfleet.manage— Manage instances and join keys
audit.read— View audit logaudit.export— Export audit dataaudit.webhook_manage— Configure audit webhooks
billing.read— View billing informationbilling.manage— Change plans and payment methods
- Additional scopes are available for fine-grained control over security settings, custom roles, compliance reporting, third-party integrations, and notification preferences.
Managing Keys
You can perform the following actions on existing keys:- Toggle status — Switch between
activeanddisabled. A disabled key rejects all requests but can be re-enabled later. - Delete permanently — Remove the key entirely. Cannot be undone.
- View permissions — Inspect the full scope set attached to a key.
Dashboard Stats
The API Keys page shows summary stats at the top:- Total keys — All keys ever created (including deleted)
- Active keys — Keys currently in
activestatus - API calls (24h) — Total API calls across all keys in the last 24 hours
- Last call — Timestamp of the most recent API call from any key
Plan Limits
| Plan | Max API Keys |
|---|---|
| Free | 3 |
| Developer | 10 |
| Pro | 20 |
| Enterprise | Unlimited |