> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing API keys

> Create, rotate, and delete the API keys your integrations use.

You create and manage API keys in **Settings → API** in the Secfix app. There is no API for it. Each
API key belongs to one workspace, has one access level, and has one active token at a time. It has a
**client ID** and a **client secret** that you use to get tokens.

## Create an API key

**1. Open Settings → API**

In the Secfix app, go to **Settings → API**. You need permission to manage API keys in your
workspace.

**2. Create the API key**

Give it a **name** and choose its access level. Grant only what the integration needs, such as
**Read** for a read-only inventory sync. You can grant only an access level your own role covers
for all data. See [Who can grant an access level](https://developer-staging.secfix.com/scopes.md#who-can-grant-an-access-level).

**3. Copy the client secret**

You get a **`client_id`** and a **`client_secret`**. The secret is shown **once** and never
again. Store it in your secrets manager right away. You can rotate it later.

## Access levels

Each API key has one of three access levels. Each level grants [scopes](https://developer-staging.secfix.com/scopes.md):

| Access level | Scopes |
| - | - |
| **Read** | `all:read` |
| **Write** | `all:write` |
| **Full access** | `all:read` and `all:write` |

`all:read` grants read access to every resource. `all:write` grants write access to every resource.
See [Scopes](https://developer-staging.secfix.com/scopes.md).

If you edit an API key and remove a scope, its current access token stops working and returns
`401 token_superseded`. Get a new token, which has the new access level.

## Rotate the secret

Rotating the secret gives you a new `client_secret`. The current access token stops working at once
and returns `401 token_superseded`, because an API key has only one active token. Get a new token with
the new secret. See [Authentication](https://developer-staging.secfix.com/authentication.md).

## Delete an API key

Deleting an API key permanently revokes its credentials and its active token. Requests with that
token then return `401 token_superseded`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.