> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rescueconsole.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Make a key that lets a script, a spreadsheet or your website reach your data, choose what it may do, and revoke it.

Open **Settings → Advanced & security → API keys** to make a key for something that is not a browser: a script, a spreadsheet, your website. A key lets that program read or change your data with exactly the permissions you choose. How a program uses a key is in the [API reference](/api-reference/introduction).

## Who can make and revoke keys

You need **Configure** on at least one workspace. Without it the page says *You need admin access to at least one module to create an API key.*

A key can never do more than the person who makes it. In the permission grid, anything you do not have yourself is greyed out, because a key you make cannot have it either.

## Making a key

<Steps>
  <Step title="Start a new key">
    Press **New key**. The **New API key** card opens.
  </Step>

  <Step title="Say what it is for">
    Under **What is it for?**, type a name, such as *Website adoptable list*. It is how you tell keys apart later, up to 100 characters.
  </Step>

  <Step title="Choose what it may do">
    Under **What may it do?**, tick what the key may do in each workspace. Choose at least one.
  </Step>

  <Step title="Choose when it expires, if ever">
    **Expires** is optional. Leave it empty for a key that does not expire on its own.
  </Step>

  <Step title="Create it and copy it">
    Press **Create key**, then **Copy**, and keep the key somewhere safe before you press **I've saved it**.
  </Step>
</Steps>

## What a key may do

The grid under **What may it do?** has a row for each workspace and three columns:

| Column        | What it lets the key do                                         |
| ------------- | --------------------------------------------------------------- |
| **See**       | View records in this workspace.                                 |
| **Change**    | Add and edit records.                                           |
| **Configure** | Change how the workspace works (custom fields, statuses, fees). |

Ticking **Configure** ticks **Change** and **See** too, and ticking **Change** ticks **See**: a key cannot change what it cannot see. Unticking **See** clears the row.

A key reaches the workspaces, and tasks, activity, the calendar, and forms and their submissions, as far as its permissions allow. It never reaches your team members, roles, organization settings or other keys, whatever you tick.

The permissions are fixed when the key is made. If the person who made it later loses a permission, the key keeps it. Revoke the key if that matters.

## The key is shown once

When you press **Create key**, the key appears in a panel headed *Copy "Website adoptable list" now. This is the only time it is shown*. RescueConsole keeps only a fingerprint of it, so it cannot be shown again or recovered. If you lose it, revoke it and make another.

The panel stays until you press **I've saved it**.

<Warning>
  A key is a password that does not expire on its own and cannot be recovered. Keep it out of anything public: a web page's code, a shared document, a public code repository. Revoke it the moment you suspect it has been seen.
</Warning>

## Where a key works

A key works only at your own organization's address. The same key sent to any other organization's address is not accepted.

## The list of keys

Each key in the list shows its name, the first few characters of the key so you can match it to the one a program holds, what it may do, who created it and when, when it was **last used** or that it was **never used**, and when it **expires**. A key past its expiry date is marked **Expired**; a revoked key is marked **Revoked**. A key that was never used is often one nobody needs.

## Expiry

A key with an **Expires** date works until the end of that day, in UTC, and then stops. You cannot choose a date already past. An expired key stays in the list, marked **Expired**. To keep a program working, make a new key before the old one expires.

## Revoking a key

Press **Revoke** beside the key. The row says *Anything using it stops working.*; press **Revoke** again to confirm, or **Cancel**.

Revoking takes effect on the very next request. It cannot be undone: a revoked key never works again, so a program that still needs access needs a new key. The revoked key stays in the list, with who made it and when it was last used, as a record that it existed.