# API keys with the CLI

[Read this page in HTML](https://www.scopedb.io/docs/guides/scopedb-cli/api-keys)

These commands use your [CLI login and selected workspace](https://www.scopedb.io/docs/guides/scopedb-cli/connect.md). An application API key cannot manage keys through the CLI.

## Create a key

With a CLI login and a selected workspace, show its endpoint and create an application key:

```bash
scope workspace get
scope api-key create my-app --expires-in 720h
```

The key is shown only once. Store it in your application's secret manager, then pass it and the workspace endpoint explicitly to your application using the [connection guide](https://www.scopedb.io/docs/guides/connect-to-scopedb.md). SDKs do not read the CLI's stored login.

## List and revoke keys

The workspace owner can list and revoke every key in the workspace; members can list and revoke only keys they created. `scope api-key list` shows each key's ID and creator, so you can distinguish keys with the same name. The ID is a non-secret identifier; the complete secret returned by `create` is used for authentication.

```bash
scope api-key list
scope api-key revoke '<key-id>'
```

Replace `<key-id>` with the ID shown by `list`. Interactive confirmation identifies the key's name and ID. A unique name is also accepted, but repeated names require an ID; an exact ID match takes precedence over a matching name.

For automation, pass the ID explicitly and skip confirmation:

```bash
scope api-key revoke '<key-id>' --yes --format json
```

JSON results contain `id`, `name`, and `revoked`. Declining an interactive confirmation returns `revoked: false` without revoking the key. Revocation does not end your CLI login.

## Related contents

* [Connect the CLI](https://www.scopedb.io/docs/guides/scopedb-cli/connect.md)

* [Connect a client](https://www.scopedb.io/docs/guides/connect-to-scopedb.md)

* [Automation](https://www.scopedb.io/docs/guides/scopedb-cli/automation.md)