> ## Documentation Index
> Fetch the complete documentation index at: https://cubed3-igor-document-row-level-allow-all.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, scope, and revoke API keys through Admin → API Keys.

Create and revoke API keys for your Cube organization.

<video autoPlay muted loop playsInline className="w-full aspect-video rounded-xl block dark:hidden" src="https://ucarecdn.com/75100f27-d155-421b-9910-19afbb2fa9fd/abf7f59d-light.mp4" />

<video autoPlay muted loop playsInline className="w-full aspect-video rounded-xl hidden dark:block" src="https://ucarecdn.com/aaa1eb9c-004d-417e-8c96-064ab0134ab1/523b2e1b-dark.mp4" />

## Personal API keys

Only admins can hold API keys unless you turn on **Allow all users to create API
keys** on the **Admin → Settings** page. With it on, every user reaches **Admin →
API Keys** and manages their own keys there — an admin still sees every key in the
account, while everyone else sees only theirs.

A personal key carries exactly its owner's permissions, so it never reaches data
or settings its owner can't reach in the app, and it can only be scoped to
deployments its owner has access to. Those permissions are what keeps a personal
key narrower than an admin's, so the switch can only be turned on while your
account enforces [roles and
permissions](/admin/users-and-permissions/roles-and-permissions). Turning it back
off doesn't delete existing personal keys, but it stops them authenticating: every
request made with one is rejected with `403 Forbidden` until it's turned on again.

Endpoints that act on behalf of someone else still require an admin's key —
[generating an embed session](/reference/embed-apis/generate-session) is the main
one.

## Deployment scope

By default, an API key is **not scoped** to any deployment—it can be used with
every deployment in your organization (the **All deployments** option). When
creating or editing a key, you can instead scope it to one or more **specific
deployments**.

The scope determines which requests a key can authorize:

* **Deployment-scoped endpoints**—such as generating an embed session for a
  deployment—require the key to be scoped either to that deployment or to all
  deployments. A request targeting a deployment outside the key's scope is
  rejected.
* **Endpoints that aren't tied to a specific deployment** continue to work with
  any key, regardless of its scope.

Each key's scope—**All** or the specific deployments it's limited to—is shown in
the API keys table.

<Note>
  Scoping is optional and backward compatible. Existing keys remain unscoped (**All
  deployments**) until you change them.
</Note>