# API keys

> Create, scope, rate-limit and revoke Agent API keys in the Console.

## Create a key

<Steps>
<Step title="Open API keys">
In the [Console](https://console.clatterlabs.com/api-keys), go to **API keys** › **Create key**.
</Step>
<Step title="Name it and pick permissions">
| Permission | Allows |
| --- | --- |
| `runs:write` | Create and cancel runs |
| `runs:read` | Read runs, events and results |
| `account:read` | Read credit balance and usage |
| `models:invoke` | Call models through the [Model API](/model-api/overview) |
</Step>
<Step title="Pick a rate limit">
10, 30 (default), 60 or 120 requests per minute. Each key has its own limit.
</Step>
<Step title="Copy it">
The key (`clsk_…`) is shown **once**. Clatter Labs stores only a keyed hash, so a lost key can't be recovered; create a new one.
</Step>
</Steps>

## Use it

Send the key with your **Account ID** on every request:

```http
Authorization: Bearer clsk_...
X-Clatter-Account: CL-XXXXXXXX
```

The Account ID must be the key owner's. This means a key copied out of a log isn't enough on its own.

## Revoke

Revoke a key from **API keys** at any time. Requests with it fail right away with `401 invalid_api_key`, and an open event stream ends with an `error` event.

## Limits

An account can hold up to **25** keys.

<Warning>
Never put a key in front-end code, a mobile app, a public repo or a screenshot. If one leaks, revoke it first, then rotate.
</Warning>