> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User API keys

> Create and manage Admin, User, and Personal API keys in env zero for REST API access, Terraform provider use, and module registry with RBAC-scoped permissions.

As an organization admin, it is possible to create API keys that can use env zero without interacting with the UI. For example, you can call the [API](https://docs.envzero.com/api-reference/credentials/create-api-key.md) directly, use the [Terraform provider](https://docs.envzero.com/guides/community-and-resources/support-and-help/terraform-provider.md), or use the [Private Module Registry](https://docs.envzero.com/guides/admin-guide/private-registry/modules.md).

> [!WARNING]
>
> Deleting an API key
>
> When deleting an API key it might take up to 1 hour for it to completely expire.

## How to create an API key

From *Organization Settings*  navigate to *API Keys* tab:

![Organization Settings API Keys tab showing existing keys and the Add button](https://mintcdn.com/envzero-b61043c8/ngeLWWxxE3C57X-b/images/guides/admin-guide/user-role-and-team-management/55ece3b-screen_shot_2022-05-24_at_12.png?fit=max\&auto=format\&n=ngeLWWxxE3C57X-b\&q=85\&s=2e548de9416493175553bd64d5d19f8f)

Click the + button to see the create API key modal.\
By default, the role of the key will be Admin, but you can also assign it to a user role, and provide specific project permission (the same as when [inviting a new user](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/user-management.md#invite-users-to-an-organization) to the platform):

![Create API key modal showing role selection and project permission assignment options](https://mintcdn.com/envzero-b61043c8/ngeLWWxxE3C57X-b/images/guides/admin-guide/user-role-and-team-management/87bb66d-screen_shot_2022-05-24_at_16.png?fit=max\&auto=format\&n=ngeLWWxxE3C57X-b\&q=85\&s=90da1989fdd6978e5cf46d3974dfa1a3)

## Admin API key

With an admin API key, you can perform any request that requires admin permission: changing organization settings, deploying and approving environments, etc.\
You can check our full API in the [API reference](https://docs.envzero.com/api-reference).

## Non-Admin API key

With a non-admin (User) API key, you can provide members of your team with the ability to use our API, while maintaining your organization's [RBAC](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/rbac.md).\
When creating a user API key, it can be configured with specific project permissions, assigned to a team, and treated like any other user in the system.

![Create user API key form showing project permissions and team assignment fields](https://mintcdn.com/envzero-b61043c8/ngeLWWxxE3C57X-b/images/guides/admin-guide/user-role-and-team-management/ff6e406-screen_shot_2022-05-24_at_18.png?fit=max\&auto=format\&n=ngeLWWxxE3C57X-b\&q=85\&s=9da1519619c2080840902fe28290fb99)

## Read-only API key

Select **Read-only** when you create an admin or user API key, or send `"readOnly": true` to [Create API Key](https://docs.envzero.com/api-reference/credentials/create-api-key.md). A read-only key keeps only the view permissions of its role, such as View Environment, View Project, View Audit Logs, and Read State. It can't create, update, or delete resources, and it can't run plans or tasks. A request that needs another permission fails with `403`.

The **Read-only** column on the *API Keys* tab marks these keys. You can't make an existing key read-only, so create a new one. Personal API keys can't be read-only.

### Read access to every project

To give an integration read access to your whole organization, create an **Admin** API key and select **Read-only**. You don't need to select any projects. An organization role covers every project in the organization, so the key can also read projects created after it.

A **User** key can read only the projects that its own project permissions or its teams give it. You can't edit the key's own project permissions after you create it.

## Allowed IPs

Any API key, including a personal API key, can be limited to a list of IP addresses. Enter them in **Allowed IPs** when you create the key, or click the edit button next to an existing key. The **Allowed IPs** column shows each key's list, and **Any IP** for a key without one.

Your organization's [IP allowlist](https://docs.envzero.com/guides/overview/security-overview/ip-allowlisting.md) still applies on top of the key's list. For the entry format and the API, see [Allowed IPs for one API key](https://docs.envzero.com/guides/overview/security-overview/ip-allowlisting.md#allowed-ips-for-one-api-key).

## Personal API key

With a personal API key, members of your team can be provided with the ability to use our API with the same permissions they have configured in their env zero account.

Every user can generate a personal API key, you can read more about it in our [API docs](https://docs.envzero.com/api-reference/credentials/create-api-key.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.