# API Keys

> Create and manage service accounts for programmatic access to the CloudBolt API

---

Site [llms.txt](/llms.txt)

---

Each API key is an OAuth2 service account that authenticates using the client credentials flow.

API keys are scoped to read-only reporting access (`reporting:viewer`). The scope is fixed and cannot be changed when creating a key.

Only users with the Owner role can view the API Keys page and manage keys.

## Access the API Keys page

1. Log in to the CloudBolt Platform.
1. In the sidebar, select **Settings**.
1. Select **API Keys**.

## API Keys overview

Key areas of the API Keys page:

| Section | Description |
| --- | --- |
| Create API key | Creates a new service account. Enter a **Name** and select **Create**. The client secret is displayed immediately after creation. Copy and store it securely, because it cannot be viewed again. |
| Keys table | Lists your service accounts with their **Name**, **Client ID** (with a copy button), **Created** date, **Last login** (**Never** if unused), and **Status** (**Active** or **Blocked**). |
| Delete | Removes a service account. Deletion immediately revokes the key's access and cannot be undone. |
| Quick start | Reference guidance below the table for obtaining a token and calling the API. |

## Rotate a key

There is no in-place rotation. To rotate a key, delete the existing key and create a new one, then update your integration with the new client ID and secret.