---
title: "API keys and permissions"
description: "Create organization API keys with product, capability, and project scopes. Store the one-time secret, rotate keys, and understand revocation limits."
image: "https://docs.sinecloud.dev/opengraph.png"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.sinecloud.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and permissions

An organization API key provides programmatic access to Agents, Box, Powers, or Gateway. Console uses your signed-in session and does not require a key. Only an [owner or admin](/organizations/) of the selected organization can create, list, or revoke keys.

## Create a key

1. Open [Console](https://sinecloud.dev/en/dashboard), select the target organization, and open API Keys. Product API pages can preselect their product and project scope.
2. Create a key and give it a name that describes its purpose.
3. Select one or more products, then choose permissions separately for each product.
4. Choose the entire organization or a specific project, and set an expiration.
5. Immediately copy the complete key into your application's secret configuration or secret manager.

**The complete key is shown only once.** Closing the result, leaving the page, or switching organizations removes access to it; the list shows only a prefix. If you no longer have the complete key, revoke it and create another.

## Product permissions

| Product | Available capabilities |
| --- | --- |
| [Agents](/products/agents/) | `agentRun`, with optional `browserRun` and `sandboxRun`. |
| [Box](/products/box/) | `fileRead`, with optional `fileWrite` and `boxRun`. |
| [Powers](/products/powers/) | `catalogRead`, `connectionRead`, `connectionWrite`, `toolRun`, `runRead`, `usageRead`. |
| [Gateway](/products/gateway/) | `modelRead`, `modelInvoke`, `configRead`, `configWrite`, `usageRead`. |

Agents and Box require their respective base capabilities, `agentRun` and `fileRead`. Powers and Gateway accept any nonempty capability set. A Gateway key used only for model calls can have just `modelInvoke`; add `modelRead` if it needs to list models.

One key can cover several products, but grants remain separate. Powers `usageRead` does not grant Gateway usage access, and Agents access does not grant direct Box access. Key scopes cannot expand organization entitlements. Granting `browserRun` does not guarantee complete browser automation in the current environment.

## Project scope

- **Entire organization:** covers the selected products in current and future projects, plus resources without a project, subject to actual permissions.
- **Specific project:** restricts all selected products to that project. Request parameters and headers cannot widen the scope.

Separate application keys allow independent revocation and narrower permissions. Some organization-wide management functions, such as [Gateway budget management](/products/gateway/), require an organization-scoped key.

## Use and rotate keys

Use the endpoint shown on the product's API page and send your organization API key in the `Authorization: Bearer` header. Keep keys out of public webpages, repositories, URLs, and logs. Provider BYOK credentials belong in product connection settings and do not replace an organization API key.

Use `https://sinecloud.dev` plus the documented complete path, with your actual resource IDs.

To rotate, create a replacement key, update the application, and revoke the old key. If the creation response is uncertain, inspect the list and recover using the original creation draft. Revoke an unrecoverable key before replacing it instead of repeatedly submitting new creation requests.

## Revoke or retire access

Check a key's permissions and details, then confirm revocation. Revocation is permanent and blocks all product grants on that key. Historical financial records remain available.

Expiration, a banned creator, or loss of the creator's organization management role prevents new requests. Rejoining the organization or regaining admin status does not restore old keys. Suspended or expired organizations or resources can also block execution.

Revocation **does not automatically cancel work already started or existing event subscriptions**. Use the relevant product's cancellation or pause controls when needed, and inspect the outcome in [Usage and Billing](/billing/).

Source: https://docs.sinecloud.dev/api-keys/index.mdx