> ## Documentation Index > Fetch the complete documentation index at: https://docs.os.meetluno.ai/llms.txt > Use this file to discover all available pages before exploring further. # API keys > Create, revoke, and use org-scoped platform API keys. API keys let scripts and external tools authenticate to the Luno OS platform without an interactive browser session. They belong to an organization and act as the user who created them, or as a [service account](#service-accounts). Use **Governance → API keys** (`/settings/api-keys`) to create, copy, review, and revoke keys for the active organization. ## What API keys can access Organization API keys authenticate to platform APIs for the organization they were created in. The key inherits the creator's organization role and access. That means a key created by an admin can access admin-level platform APIs, while a key created by a builder is limited to builder-level access. Each key also has a **scope** that narrows (never widens) what that role allows: | Scope | What the key can do | | - | - | | **Read** | Read-only requests (`GET`/`HEAD`) | | **Write** (default) | Everything except organization administration: org settings, members, API keys, billing, managed services, organization credentials and enterprise settings | | **Admin** | Everything the role allows | **Read** allows `GET`/`HEAD` requests (minus organization administration, as for **Write**) and refuses every other method, including read-like `POST` endpoints such as searches or queries. Use a **Write** key for those. A Read key is also never treated as a deployer, so trigger webhook URLs (which embed their ingress token) are left out of its responses. A key can also be **restricted to one project**, and optionally to specific agents and workflows in it (read or write scope only). It then sees every other project as missing and can only use the resources it names. See [Governance](https://docs.os.meetluno.ai/learn/projects/governance.md#api-key-restrictions). Keys created before scopes existed are **Admin** keys, so they keep working exactly as before. Hosted MCP servers need a **Write** or **Admin** key, since their tools run workflows. Keys can optionally **expire** (30 days, 90 days, 1 year, or never). Expired keys stop authenticating. The **Last used** time is updated at most once a minute. ## Service accounts A personal key stops working when its creator leaves the organization. For CI and long-lived integrations, owners and admins can instead create a key that acts as a **service account**: a new, non-human organization member named after the key, with the **Builder** or **Admin** role you pick. Nobody can sign in as a service account. Service account keys keep working after the person who created them leaves. They are listed in **Governance → People** like any member (add a builder service account to the projects it needs). Revoking the key also removes the service account. API keys can be sent as: ```bash theme={null} Authorization: Bearer x-api-key: ``` Some webhook-style endpoints also accept `?token=` or `?api_key=` query parameters. Prefer headers for new scripts. ## API keys and the CLI API keys have nothing to do with CLI access today. The CLI is authenticated and accessed at the user level, not with org-scoped API keys. When you run `luno auth login`, you authenticate as a user. From there, the CLI can access every organization you belong to and switch between them. It is not scoped to a single organization the way an API key is. So use API keys for scripts and external tools hitting the platform API, and use `luno auth login` for CLI work like `luno deploy` on your own machine. Hosted sessions (the in-app [Luno Builder](https://docs.os.meetluno.ai/build-with-ai/platform-agent.md), [MCP](https://docs.os.meetluno.ai/build-with-ai/mcp-for-agents.md) workspaces) are already authenticated and never run `auth login`. ## Create a key Create API keys from the web app or the CLI. ```bash theme={null} luno api-key create --name "Production automation" # write scope, never expires luno api-key create --name "Dashboards" --scope read --expires-in 90 luno api-key create --name "Deploy bot" --service-account builder luno api-key create --name "Support widget" --project support-automations --agent support-bot ``` The secret is shown only when the key is created. Copy it immediately and store it somewhere safe. After you close the reveal dialog or lose the CLI output, Luno OS only shows the key preview. The API keys table shows: | Column | What it means | | - | - | | **Name** | The label you gave the key | | **Key preview** | A non-secret preview for identifying the key | | **Scope** | Read, Write or Admin, and whether the key acts as a service account | | **Restriction** | The project (and agents or workflows) the key is pinned to, or the whole organization | | **Expires** | When the key stops working, or Never | | **Last used** | The last time the key authenticated a request (to the minute) | | **Created at** | When the key was created | | **Created by** | The member who created the key, when your role can see it | ## Visibility and permissions API key visibility depends on your organization role: | Role | What it can do | | - | - | | **Owner** | View all keys, create keys, and revoke any key | | **Admin** | View all keys, create keys, and revoke any key | | **Builder** | Create keys and view keys they created | Any member can revoke their own keys. Owners and admins can revoke keys created by other members. ## Revoke a key Revoke a key when it is no longer needed, when a teammate leaves, or when you think the secret may have been exposed. ```bash theme={null} luno api-key list luno api-key revoke --yes ``` Revocation takes effect immediately. Any requests using that key will stop authenticating. ## Use keys in scripts Store the key in an environment variable and pass it as a header: ```bash theme={null} export LUNO_API_KEY="key_live_..." export LUNO_PLATFORM_URL="https://" curl "$LUNO_PLATFORM_URL/api/projects" \ -H "Authorization: Bearer $LUNO_API_KEY" ``` Use separate keys for separate scripts or environments. Naming keys clearly makes it easier to revoke the right one later. ## Next steps > **[Members](https://docs.os.meetluno.ai/learn/settings/members.md)** > > Understand the organization roles API keys inherit. > **[Organization](https://docs.os.meetluno.ai/learn/settings/organization.md)** > > Manage organization-wide settings. > **[CLI reference](https://docs.os.meetluno.ai/cli.md#organization-and-access)** > > See the API key command reference. > **[Credentials](https://docs.os.meetluno.ai/learn/credentials/overview.md)** > > Store runtime credentials for agents and workflows. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.