# API Keys Source: https://docs.chain.link/chainlink-platform/api-keys Last Updated: 2026-10-15 > For the complete documentation index, see [llms.txt](/llms.txt). API keys authenticate programmatic access to Chainlink Platform products, such as the CRE CLI, the ACE APIs, and the CRE Connect API. This page describes how API key permissions work, which permissions are available for each product, and how to create and manage API keys. ## How API keys work An API key is an organization-level credential. When you create an API key, you select the permissions the key has, and the key can act only within those permissions. - A single API key can include permissions for multiple products. For example, one key can deploy CRE workflows and read ACE reports. - API key permissions are a subset of all permissions. Some permissions, such as managing members or billing, are available only to organization members through their roles. - An API key's access is determined by the permissions you select for it, not by your own role. To create and manage API keys, you need a role that includes API key permissions, such as Platform User, Platform Admin, or Owner. See [RBAC](/chainlink-platform/rbac) for the full list of roles. ## Available permissions The following tables list the permissions you can assign to an API key for each product. Each row matches a permission group in the **API Scope** section of the creation form: the **Setting** column is what to select for that group, and the **Permission IDs** column lists the permission IDs that the setting grants. A check mark indicates that the role includes the permissions the setting grants. The Owner role includes every permission for every product. ### Chainlink Platform | Permission | Setting | Permission IDs | Admin | User | | ------------- | ------- | ----------------------------- | ----- | ---- | | Organization | Read | `platform:organization:read` | ✓ | ✓ | | Owner address | Read | `platform:owner_address:read` | ✓ | ✓ | ### CRE | Permission | Setting | Permission IDs | Admin | Developer | Viewer | | --------------------- | ------- | ----------------------------------------------------------- | ----- | --------- | ------ | | Workflow | Read | `cre:workflow:read` | ✓ | ✓ | ✓ | | Workflow | All | `cre:workflow:read`, `cre:workflow:write/private_registry` | ✓ | ✓ | | | Workflow artifact | Read | `cre:workflow:artifact:read` | ✓ | ✓ | ✓ | | Workflow artifact | All | `cre:workflow:artifact:read`, `cre:workflow:artifact:write` | ✓ | ✓ | | | Owner address linking | All | `platform:owner_address:linking:write/cre` | ✓ | | | ### ACE #### Administration | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ----------- | ------- | -------------------------------- | ----- | -------- | ------ | | Member role | All | `platform:member_role:write/ace` | ✓ | | | #### Policy Manager | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | --------------------------------------------------------------------------- | ------- | ----------------------------------------------------------------------------------- | ----- | -------- | ------ | | Policy manager policy engine | Read | `ace:policy_manager:policy_engine:read` | ✓ | ✓ | ✓ | | Policy manager policy engine | All | `ace:policy_manager:policy_engine:read`, `ace:policy_manager:policy_engine:write` | ✓ | ✓ | | | Policy manager policy engine archive (affects everything deployed under it) | All | `ace:policy_manager:policy_engine:archive:write` | ✓ | | | | Policy manager policy | Read | `ace:policy_manager:policy:read` | ✓ | ✓ | ✓ | | Policy manager policy | All | `ace:policy_manager:policy:read`, `ace:policy_manager:policy:write` | ✓ | ✓ | | | Policy manager policy archive | All | `ace:policy_manager:policy:archive:write` | ✓ | ✓ | | | Policy manager target | Read | `ace:policy_manager:target:read` | ✓ | ✓ | ✓ | | Policy manager target | All | `ace:policy_manager:target:read`, `ace:policy_manager:target:write` | ✓ | ✓ | | | Policy manager target archive | All | `ace:policy_manager:target:archive:write` | ✓ | ✓ | | | Policy manager target access | Read | `ace:policy_manager:target_access:read` | ✓ | | | | Policy manager target access | All | `ace:policy_manager:target_access:read`, `ace:policy_manager:target_access:write` | ✓ | | | | Policy manager implementation | Read | `ace:policy_manager:implementation:read` | ✓ | ✓ | ✓ | | Policy manager implementation | All | `ace:policy_manager:implementation:read`, `ace:policy_manager:implementation:write` | ✓ | ✓ | | | Policy manager implementation archive (affects every instance built on it) | All | `ace:policy_manager:implementation:archive:write` | ✓ | | | #### Identity Manager | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ------------------------------------------------------------------------ | ------- | ----------------------------------------------------------------------------------------- | ----- | -------- | ------ | | Identity manager registry | Read | `ace:identity_manager:registry:read` | ✓ | ✓ | ✓ | | Identity manager registry | All | `ace:identity_manager:registry:read`, `ace:identity_manager:registry:write` | ✓ | ✓ | | | Identity manager registry archive (affects everything deployed under it) | All | `ace:identity_manager:registry:archive:write` | ✓ | | | | Identity manager registry access | Read | `ace:identity_manager:registry_access:read` | ✓ | | | | Identity manager registry access | All | `ace:identity_manager:registry_access:read`, `ace:identity_manager:registry_access:write` | ✓ | | | | Identity manager identity | Read | `ace:identity_manager:identity:read` | ✓ | ✓ | ✓ | | Identity manager identity | All | `ace:identity_manager:identity:read`, `ace:identity_manager:identity:write` | ✓ | ✓ | | | Identity manager identity archive | All | `ace:identity_manager:identity:archive:write` | ✓ | ✓ | | #### Reporting | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | --------------------- | ------- | -------------------------------- | ----- | -------- | ------ | | Reporting policy | Read | `ace:reporting:policy:read` | ✓ | ✓ | ✓ | | Reporting identity | Read | `ace:reporting:identity:read` | ✓ | ✓ | ✓ | | Reporting target | Read | `ace:reporting:target:read` | ✓ | ✓ | ✓ | | Reporting transaction | Read | `ace:reporting:transaction:read` | ✓ | ✓ | ✓ | | Reporting permit | Read | `ace:reporting:permit:read` | ✓ | ✓ | ✓ | | Reporting registry | Read | `ace:reporting:registry:read` | ✓ | ✓ | ✓ | #### Evaluation | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ----------------- | ------- | ----------------------------------------------------------- | ----- | -------- | ------ | | Evaluation permit | Read | `ace:evaluation:permit:read` | ✓ | ✓ | ✓ | | Evaluation permit | All | `ace:evaluation:permit:read`, `ace:evaluation:permit:write` | ✓ | ✓ | | #### Core | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | --------------- | ------- | ----------------------------------------------- | ----- | -------- | ------ | | Core org config | Read | `ace:core:org_config:read` | ✓ | ✓ | ✓ | | Core network | Read | `ace:core:network:read` | ✓ | ✓ | ✓ | | Core wallet | Read | `ace:core:wallet:read` | ✓ | ✓ | ✓ | | Core wallet | All | `ace:core:wallet:read`, `ace:core:wallet:write` | ✓ | | | #### Active Monitoring | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ------------------------------------ | ------- | ------------------------------------------------------------------------------------------------- | ----- | -------- | ------ | | Active monitoring action variable | Read | `ace:active_monitoring:action_variable:read` | ✓ | ✓ | ✓ | | Active monitoring contract group | Read | `ace:active_monitoring:contract_group:read` | ✓ | ✓ | ✓ | | Active monitoring contract group | All | `ace:active_monitoring:contract_group:read`, `ace:active_monitoring:contract_group:write` | ✓ | ✓ | | | Active monitoring rule group | Read | `ace:active_monitoring:rule_group:read` | ✓ | ✓ | ✓ | | Active monitoring rule group | All | `ace:active_monitoring:rule_group:read`, `ace:active_monitoring:rule_group:write` | ✓ | ✓ | | | Active monitoring monitored address | Read | `ace:active_monitoring:monitored_address:read` | ✓ | ✓ | ✓ | | Active monitoring monitored address | All | `ace:active_monitoring:monitored_address:read`, `ace:active_monitoring:monitored_address:write` | ✓ | ✓ | | | Active monitoring screening interval | Read | `ace:active_monitoring:screening_interval:read` | ✓ | ✓ | ✓ | | Active monitoring screening interval | All | `ace:active_monitoring:screening_interval:read`, `ace:active_monitoring:screening_interval:write` | ✓ | ✓ | | | Active monitoring decision log | Read | `ace:active_monitoring:decision_log:read` | ✓ | ✓ | ✓ | | Active monitoring decision log | All | `ace:active_monitoring:decision_log:read`, `ace:active_monitoring:decision_log:write` | ✓ | ✓ | | | Active monitoring provider api key | Read | `ace:active_monitoring:provider_api_key:read` | ✓ | ✓ | ✓ | | Active monitoring provider api key | All | `ace:active_monitoring:provider_api_key:read`, `ace:active_monitoring:provider_api_key:write` | ✓ | | | ### CRE Connect #### Core | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | -------------- | ------- | --------------------------------------- | ----- | -------- | ------ | | Network | Read | `crec:network:read` | ✓ | ✓ | ✓ | | Wallet | Read | `crec:wallet:read` | ✓ | ✓ | ✓ | | Wallet | All | `crec:wallet:read`, `crec:wallet:write` | ✓ | ✓ | | | Wallet archive | All | `crec:wallet:archive:write` | ✓ | | | #### Operations | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ------------------- | ------- | --------------------------------------------- | ----- | -------- | ------ | | Operation | Read | `crec:operation:read` | ✓ | ✓ | ✓ | | Operation | All | `crec:operation:read`, `crec:operation:write` | ✓ | ✓ | | | Operation signature | All | `crec:operation:signature:write` | ✓ | ✓ | | #### Channels | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | --------------- | ------- | ----------------------------------------- | ----- | -------- | ------ | | Channel | Read | `crec:channel:read` | ✓ | ✓ | ✓ | | Channel | All | `crec:channel:read`, `crec:channel:write` | ✓ | ✓ | | | Channel archive | All | `crec:channel:archive:write` | ✓ | | | #### Watchers | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | --------------- | ------- | ----------------------------------------- | ----- | -------- | ------ | | Watcher | Read | `crec:watcher:read` | ✓ | ✓ | ✓ | | Watcher | All | `crec:watcher:read`, `crec:watcher:write` | ✓ | ✓ | | | Watcher archive | All | `crec:watcher:archive:write` | ✓ | | | #### Queries | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ---------- | ------- | ------------------------------------- | ----- | -------- | ------ | | Query | Read | `crec:query:read` | ✓ | ✓ | ✓ | | Query | All | `crec:query:read`, `crec:query:write` | ✓ | ✓ | | #### Events | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ---------- | ------- | ----------------- | ----- | -------- | ------ | | Event | Read | `crec:event:read` | ✓ | ✓ | ✓ | #### Administration | Permission | Setting | Permission IDs | Admin | Operator | Viewer | | ----------- | ------- | --------------------------------- | ----- | -------- | ------ | | Member role | All | `platform:member_role:write/crec` | ✓ | | | ### Data Streams and Agent Gateway API keys cannot be scoped to Data Streams or Agent Gateway. Data Streams uses its own authentication with credentials managed in the Data Streams portal. See [Data Streams API Authentication](/data-streams/reference/data-streams-api/authentication). > **CAUTION: Full access permissions** > > Selecting **All** for every permission group in a product's accordion grants the API key complete access to that product, including role management. Assign that level of access to an API key only when the key needs it. ## Creating an API key To create an API key: 1. Sign in to [app.chain.link](https://app.chain.link). 2. Click on your account's icon in the top-right corner, then click on *Org settings* in the dropdown to open the **Organization** page. 3. Click to open the **API Keys** tab and click **Create API Key**. 4. Enter a name for the key. 5. In the **API Scope** section, select the permissions for the key: - Each product (Platform, ACE, CRE, and CRE Connect) has its own accordion. Expand the products the key needs access to. - Each product has a preset: **None**, **Read**, **All**, or **Custom**. **Read** grants the product's read permissions, **All** grants every permission available for that product, and **Custom** is applied automatically when you change any individual permission. The Chainlink Platform accordion offers only **None**, **Read**, and **Custom**. - To grant individual permissions instead of a preset, set each permission group to **None**, **Read**, or **All**. Some groups offer only a subset of these options. 6. Click **Create API Key**, then copy the key and click **Done**. > **CAUTION: Copy your API key immediately** > > The API key is displayed only once after you create it. Copy and store it in a secure location before closing the dialog. If you lose the key, rotate it to generate a new value. See [Managing API keys](#managing-api-keys). ## Managing API keys The **API Keys** tab on the Organization page lists your organization's API keys with their name, key ID, author, product access, creation date, and status. Use the **Status** and **Product access** filters or the search field to find specific keys. Click a key's name to open its edit panel. The **Scopes** tab shows the same permission selection as the creation form: change the presets or individual permissions, then click **Save changes**. The **Actions** tab lists the operations you can perform on the key: - **Rename API Key**: changes the key's name. The new name is visible to all organization members. - **Rotate Key**: generates a new value for the same key. Use this when a key's value may have been exposed. - **Delete API**: permanently deletes the API key and its value. ## API key security - Never share your API keys. Each member should use keys with only the permissions they need. - If a key's value may have been exposed, rotate the key from its **Actions** tab. - Review your organization's API keys regularly and delete keys that are no longer needed. ## What's next? - [RBAC](/chainlink-platform/rbac) - Learn about member roles and what each role can do. - [Understanding Organizations](/chainlink-platform/understanding-organizations) - Learn how organizations work on the Chainlink Platform. - [Inviting Team Members](/chainlink-platform/inviting-team-members) - Add members to your organization.