> ## Documentation Index
> Fetch the complete documentation index at: https://docs.context.dev/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Setting up Context.dev for a user? Follow https://docs.context.dev/agent-quickstart.md. MCP clients sign in with OAuth and need no API key; application code reads CONTEXT_DEV_API_KEY.

# API keys

> Create restricted credentials, inspect usage, and rotate access safely.

Manage organization keys on the [API keys page](https://context.dev/dashboard/api-keys). Free organizations can have two keys; paid organizations can have 50. Keep secret keys in a server-side secret store.

## Choose permissions

New keys default to **Full access**, including future API groups. **Restricted** keys receive only their explicit grants. A restricted key with no scopes can still submit agent feedback.

| Dashboard group | Level                | Scope                               |
| --------------- | -------------------- | ----------------------------------- |
| Data APIs       | None / Use           | `data:execute`.                     |
| Account logs    | None / Read          | `logs:read`.                        |
| Monitors        | None / Read / Manage | `monitors:read` / `monitors:write`. |
| Batches         | None / Read / Manage | `batches:read` / `batches:write`.   |

Manage includes Read. Grants apply to all resources in the organization, not individual jobs. Managed workloads do not also require `data:execute`; that scope controls direct data calls.

## Create or change a key

Choose Full access or Restricted, save the key in your application’s secret store, and send it as a Bearer token. Changes apply to subsequent requests. Already accepted work, submitted batches, and scheduled monitors continue; stop those resources separately if needed. Renaming keys requires a paid plan.

Read access includes configurations, results, history, and delivery searches. Explicit runs, mutations, delivery retries, and secret rotation require Manage. Monitor signing secrets are omitted from read-only responses. Delivery endpoints check the source’s batch or monitor permission.

A missing grant returns `403 INSUFFICIENT_PERMISSIONS` with `required_permission` when identifiable. [Team roles](/account/team) control dashboard access separately; scopes are not spending caps.

## Inspect usage and retire keys

A key’s usage link opens its recent usage and request logs. The Logs API accepts `key_id` with a `logs:read` key.

To rotate, create a replacement, update the application, verify it, then disable the old key. Disable or delete retired keys from their action menu. Removing a teammate does not erase copied shared keys; rotate those keys when offboarding.