> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing API keys

> Create and manage the API keys that hold your credentials and access.

API keys are created and managed from **Settings → API** in the Secfix web app — not through the API
itself. Each API key belongs to a workspace, holds a single active token at a time, and is granted
an access level. Every key has a **client ID** and a **client secret** used to authenticate.

## Create an API key

<Steps>
  <Step title="Open Settings → API">
    In the Secfix web app, go to **Settings → API**. You need permission to manage API keys in your
    workspace.
  </Step>

  <Step title="Create the API key">
    Give it a **name**, then choose its access level. Grant the minimum the integration needs — for
    example **Read** for a read-only inventory sync. See [Scopes](/scopes).
  </Step>

  <Step title="Copy the client secret">
    On creation you receive a **`client_id`** and a **`client_secret`**. The secret is displayed
    **once** and never shown again — store it in your secrets manager immediately. You can always
    rotate it later.
  </Step>
</Steps>

## Access levels

Each API key is granted one of three access levels, which map to the underlying [scopes](/scopes):

| Access level    | Scope(s) granted         |
| --------------- | ------------------------ |
| **Read**        | `all:read`               |
| **Write**       | `all:write`              |
| **Full access** | `all:read` + `all:write` |

`all:read` grants read access to every resource and `all:write` grants write access to every
resource — see [Scopes](/scopes).

## Rotate the secret

Rotating an API key's secret issues a new `client_secret` and **immediately invalidates the current
access token** — the single-active-token rule means the previously issued token starts returning
`401 token_superseded`. After rotating, fetch a fresh token with the new secret. See
[Authentication](/authentication).

## Delete an API key

Deleting an API key permanently revokes its credentials and any active token. Requests made with its
token afterward fail with `401 unauthorized`.

<Note>
  There is no API to create or manage API keys — this is a deliberate security boundary. The
  credential lifecycle lives entirely in **Settings → API** in the Secfix web app.
</Note>