# API keys

> Create, list, and revoke the Okibi API keys that okibi and your CI jobs use.

An Okibi API key lets okibi act as you. It manages your Okibi account and CLIs. It is not a key for your own API. You manage keys with `okibi keys`.

## Login keys and locked keys

| | Login key | Locked key |
| --- | --- | --- |
| Made by | `okibi auth login` | `okibi keys create` |
| Works in | Any workspace where you are an owner, admin, or builder | Only the workspace it is locked to |
| Use it for | Your own machine | CI jobs and shared machines |

Every key acts as you, with your role in the workspace. If you are removed from a workspace, your keys stop working there. Keys start with `okb_`.

## The key on your machine

`okibi auth login` creates an unrestricted key named `okibi CLI via browser` and stores it on this machine. [Log in](https://okibi.ai/docs/cli/login.md) explains where it is stored.

The key's home workspace is the one you pick on the approval page. okibi uses it whenever you don't pass `--workspace` or set `OKIBI_WORKSPACE`.

`okibi auth logout` removes the key from this machine, but the key stays active. Each new login makes a new key, so revoke old ones you no longer use.

## Create a locked key

```sh
okibi keys create --name github-actions --workspace acme
```

okibi prints the key once. Copy it into your secret store right away; Okibi can't show it again. Without `--workspace`, the key is locked to your default workspace.

Add `--use` to store the new key as this machine's key instead of printing it. Your previous key stays active until you revoke it.

You create, list, and revoke keys with a login key. A locked key can't manage keys, so a leaked one can't make more.

## What a locked key can't do

A locked key works only in its own workspace. It can't:

- Target another workspace, or list your other workspaces
- Create, reset, or delete workspaces
- Invite people, cancel invitations, change roles, or remove members
- Change the plan or open the billing portal
- Remove a repository from the Okibi GitHub App
- Change [Okibi Identity](https://okibi.ai/docs/guides/identity.md) credentials

Use a login key for these.

## Use a key in CI

Store the key as a secret named `OKIBI_API_KEY`. okibi reads it from the environment, so the job doesn't log in:

```sh
okibi --agent clis show my-cli
```

[Agent and CI mode](https://okibi.ai/docs/cli/agent-mode.md#run-okibi-in-ci) shows a full job.

## List and revoke keys

```sh
okibi keys list
okibi keys revoke <key-id>
```

`okibi keys list` shows every key you own, in all your workspaces. Each row has the key's ID, name, prefix, created date, last used date, and whether it is active or revoked.

> **Warning** Revoking takes effect at once. Every job that uses the key fails on its next call.

- [Log in](https://okibi.ai/docs/cli/login.md): Browser, SSH, and CI login, and where okibi stores the key.
- [Workspace and members](https://okibi.ai/docs/guides/workspaces.md): Roles decide what a key can do in each workspace.