> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage API keys for programmatic access

Create API keys to access CodeThreat programmatically via REST API.

## Create API Key

<Steps>
  <Step title="Navigate to API Keys">
    **Organization Settings** → **API Keys**
  </Step>

  <Step title="Create New Key">
    Click **Create API Key**
  </Step>

  <Step title="Configure Key">
    Set key properties:

    * **Name**: Descriptive name (e.g., "CI/CD Pipeline")
    * **Scopes**: Permissions (read:scans, write:scans, etc.)
    * **Expiration**: Optional expiration date
  </Step>

  <Step title="Generate">
    Click **Generate Key**
  </Step>

  <Step title="Copy Key">
    Copy API key immediately

    <Warning>
      You won't see the key again. Store securely.
    </Warning>
  </Step>
</Steps>

## API Key Scopes

API keys use a scope-based permission system with the format `{resource}:{action}`:

**Organization**:

* `organization:read` - View organization details
* `organization:write` - Modify organization settings
* `organization:manage` - Full organization management

**Repositories**:

* `repository:read` - View repositories
* `repository:write` - Modify repository settings
* `repository:manage` - Full repository management

**Scans**:

* `scan:read` - View scan results
* `scan:write` - Trigger and manage scans
* `scan:manage` - Full scan management

**Violations**:

* `violation:read` - View violations
* `violation:write` - Update violation status
* `violation:manage` - Full violation management

**Users**:

* `user:read` - View user information
* `user:write` - Modify user settings
* `user:manage` - Full user management

**Integrations**:

* `integration:read` - View integrations
* `integration:write` - Manage integrations

**API Keys**:

* `api-key:read` - View API keys
* `api-key:write` - Create/revoke API keys

**Webhooks**:

* `webhook:read` - View webhook configurations
* `webhook:write` - Manage webhooks

<Tip>
  Use principle of least privilege—grant only required scopes.
</Tip>

## Using API Keys

Include API key in X-API-Key header:

```bash theme={null}
curl -X GET "https://app.codethreat.com/api/v1/scans" \
  -H "X-API-Key: YOUR_API_KEY"
```

[View full API documentation →](/api-reference/authentication)

## Rotate API Keys

Regularly rotate API keys for security:

1. Create new API key
2. Update services to use new key
3. Test new key
4. Delete old key

## Best Practices

**Rotate keys regularly**: Every 90 days

**Use key per service**: Separate keys for each integration

**Set expiration dates**: Automatic key expiration

**Monitor usage**: Review API key activity logs

**Store securely**: Use secret management tools

**Revoke immediately**: Delete compromised keys

## What's Next?

<CardGroup cols={2}>
  <Card title="API Reference" icon="code" href="/api-reference/authentication">
    View API documentation
  </Card>

  <Card title="CI/CD Integration" icon="circle-nodes" href="/automation/ci-cd-integration">
    Integrate with CI/CD
  </Card>
</CardGroup>