API keys with the CLI

These commands use your CLI login and selected workspace. An application API key cannot manage keys through the CLI.

Create a key

With a CLI login and a selected workspace, show its endpoint and create an application key:

scope workspace get
scope api-key create my-app --expires-in 720h

The key is shown only once. Store it in your application's secret manager, then pass it and the workspace endpoint explicitly to your application using the connection guide. SDKs do not read the CLI's stored login.

List and revoke keys

The workspace owner can list and revoke every key in the workspace; members can list and revoke only keys they created. scope api-key list shows each key's ID and creator, so you can distinguish keys with the same name. The ID is a non-secret identifier; the complete secret returned by create is used for authentication.

scope api-key list
scope api-key revoke '<key-id>'

Replace <key-id> with the ID shown by list. Interactive confirmation identifies the key's name and ID. A unique name is also accepted, but repeated names require an ID; an exact ID match takes precedence over a matching name.

For automation, pass the ID explicitly and skip confirmation:

scope api-key revoke '<key-id>' --yes --format json

JSON results contain id, name, and revoked. Declining an interactive confirmation returns revoked: false without revoking the key. Revocation does not end your CLI login.