> ## Documentation Index
> Fetch the complete documentation index at: https://docs.2501.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Generate scoped keys to call the 2501 API programmatically

An **API key** authenticates programmatic requests to the 2501 API without a user session. Generate one from **Settings** to script against your inventory — hosts, agents, tasks, and the rest of the versioned API — from outside Command Center.

<Frame caption="Settings → API Keys: name, scope, and expiry, each row with revoke.">
  <img src="https://mintcdn.com/2501/gMl_w8qww9Zl47hO/images/api_keys.png?fit=max&auto=format&n=gMl_w8qww9Zl47hO&q=85&s=def57f98a31db66f5599c22daa9296e0" alt="API Keys" width="2934" height="520" data-path="images/api_keys.png" />
</Frame>

## Creating a key

Only **administrators** can create API keys. Open **Settings** → **API Keys** and click **New API Key**.

* **Name** — a label to recognize the key later, e.g. `cmdb-sync`.
* **Scope** — **This organization** limits every call made with the key to your current organization. Tenant-level administrators can instead choose **Entire tenant**, which lets the key act on any organization in the tenant. Org-level administrators can only mint org-scoped keys.
* **Expiration** — 30 days, 90 days, or 1 year, or check **Never expires** for a key with no expiry (up to 10 years out).

<Warning>
  The raw key is shown **exactly once**, immediately after creation. Copy it before closing the dialog — 2501 stores only its hash and cannot show it to you again. If you lose it, revoke it and create a new one.
</Warning>

## Using a key

Send it as a bearer token on the versioned API:

```bash theme={null}
curl https://<your-command-center-host>/api/v1/hosts \
  -H "Authorization: Bearer <your-api-key>"
```

A request with a valid key is treated as an administrator within the key's scope — full read/write on that organization, or the whole tenant for a tenant-scoped key. This reach is fixed at creation time: it does not change if the user who created the key is later demoted, removed, or loses org access. Only revoking or expiring the key changes what it can do.

An API key cannot be used to create, list, or revoke other API keys — key management stays session-only, so a leaked key can't mint itself a successor.

## Revoking a key

Any administrator can revoke any key in the tenant from the **API Keys** list, regardless of who created it. Revoking is immediate and permanent — there is no un-revoke, only creating a new key.

An expired key stops working on its own once its expiration date passes; you don't need to revoke it separately.