Skip to main content
As an organization admin, it is possible to create API keys that can use env zero without interacting with the UI. For example, you can call the API directly, use the Terraform provider, or use the Private Module Registry.
Deleting an API keyWhen deleting an API key it might take up to 1 hour for it to completely expire.

How to create an API key

From Organization Settings navigate to API Keys tab: Organization Settings API Keys tab showing existing keys and the Add button Click the + button to see the create API key modal.
By default, the role of the key will be Admin, but you can also assign it to a user role, and provide specific project permission (the same as when inviting a new user to the platform): Create API key modal showing role selection and project permission assignment options

Admin API key

With an admin API key, you can perform any request that requires admin permission: changing organization settings, deploying and approving environments, etc.
You can check our full API in the API reference.

Non-Admin API key

With a non-admin (User) API key, you can provide members of your team with the ability to use our API, while maintaining your organization’s RBAC.
When creating a user API key, it can be configured with specific project permissions, assigned to a team, and treated like any other user in the system. Create user API key form showing project permissions and team assignment fields

Read-only API key

Select Read-only when you create an admin or user API key, or send "readOnly": true to Create API Key. A read-only key keeps only the view permissions of its role, such as View Environment, View Project, View Audit Logs, and Read State. It can’t create, update, or delete resources, and it can’t run plans or tasks. A request that needs another permission fails with 403. The Read-only column on the API Keys tab marks these keys. You can’t make an existing key read-only, so create a new one. Personal API keys can’t be read-only.

Read access to every project

To give an integration read access to your whole organization, create an Admin API key and select Read-only. You don’t need to select any projects. An organization role covers every project in the organization, so the key can also read projects created after it. A User key can read only the projects that its own project permissions or its teams give it. You can’t edit the key’s own project permissions after you create it.

Allowed IPs

Any API key, including a personal API key, can be limited to a list of IP addresses. Enter them in Allowed IPs when you create the key, or click the edit button next to an existing key. The Allowed IPs column shows each key’s list, and Any IP for a key without one. Your organization’s IP allowlist still applies on top of the key’s list. For the entry format and the API, see Allowed IPs for one API key.

Personal API key

With a personal API key, members of your team can be provided with the ability to use our API with the same permissions they have configured in their env zero account. Every user can generate a personal API key, you can read more about it in our API docs.