For AI agents: use llms.txt as the documentation index. Retrieve the smallest relevant
.md page first.
API Keys
API keys authenticate programmatic access to Chainlink Platform products, such as the CRE CLI, the ACE APIs, and the CRE Connect API. This page describes how API key permissions work, which permissions are available for each product, and how to create and manage API keys.
An API key is an organization-level credential. When you create an API key, you select the permissions the key has, and the key can act only within those permissions.
A single API key can include permissions for multiple products. For example, one key can deploy CRE workflows and read ACE reports.
API key permissions are a subset of all permissions. Some permissions, such as managing members or billing, are available only to organization members through their roles.
An API key's access is determined by the permissions you select for it, not by your own role.
To create and manage API keys, you need a role that includes API key permissions, such as Platform User, Platform Admin, or Owner. See RBAC for the full list of roles.
The following tables list the permissions you can assign to an API key for each product. Each row matches a permission group in the API Scope section of the creation form: the Action column is what to select for that group, and the Permission ID column lists the permission ID that the action grants. A check mark indicates that the role includes the permissions the action grants. The Owner role includes every permission for every product.
API keys cannot be scoped to Data Streams. Data Streams uses its own authentication with credentials managed in the Data Streams portal. See Data Streams API Authentication.
Click on your account's icon in the top-right corner, then click on Org settings in the dropdown to open the Organization page.
Click to open the API Keys tab and click Create API Key.
Enter a name for the key.
In the API Scope section, select the permissions for the key:
Each product (Platform, ACE, CRE, and CRE Connect) has its own accordion. Expand the products the key needs access to.
Each product has a preset: None, Read, All, or Custom. Read grants the product's read permissions, All grants every permission available for that product, and Custom is applied automatically when you change any individual permission. The Chainlink Platform accordion offers only None, Read, and Custom.
To grant individual permissions instead of a preset, set each permission group to None, Read, or All. Some groups offer only a subset of these options.
Click Create API Key, then copy the key and click Done.
The API Keys tab on the Organization page lists your organization's API keys with their name, key ID, author, product access, creation date, and status. Use the Status and Product access filters or the search field to find specific keys.
Click a key's name to open its edit panel. The Scopes tab shows the same permission selection as the creation form: change the presets or individual permissions, then click Save changes. The Actions tab lists the operations you can perform on the key:
Rename API Key: changes the key's name. The new name is visible to all organization members.
Rotate Key: generates a new value for the same key. Use this when a key's value may have been exposed.
Delete API: permanently deletes the API key and its value.
