# Manage API keys

> Create, list and revoke API keys on the API keys tab of Settings, and learn what the platform API accepts today.

Source: https://docs.coritan.com/account/api-keys/

In the dashboard:

- /dashboard/settings/api-keys: https://www.coritan.com/dashboard/settings/api-keys

The **API keys** tab of **Settings** lets you create keys for scripts, each with a label, a set of permissions and an optional list of addresses it may be used from. You see each key once, when you create it.

> [!IMPORTANT]
> The Coritan API does not accept these keys yet. A request that sends one, as `Authorization: Bearer ct_...` or any other way, answers `401`. Until that changes, a script signs in and sends the access token it gets back, as [Make your first API request](/get-started/first-steps-with-the-api/) shows. Because no request can use a key, Coritan does not check its permissions or its allowed addresses either.

Other Coritan credentials do work with their own APIs:

- An [organization API key](/organizations/api-keys/) calls the [Commerce API](/organizations/storefront/commerce-api/) for one organization.
- An [SMTP Relay API key](/mail/smtp-relay/api-keys/) sends mail with the SMTP Relay API.

## Before you begin

- Sign in to the [dashboard](https://www.coritan.com/dashboard).

## Create a key

1. In the sidebar, select **Settings**, then the **API keys** tab.
2. Select **Create API key…**.
3. Type a **Label**, such as `CI deploys`, so you can tell the key apart from your others. It can be up to 100 characters.
4. Under **Permissions**, tick **Read** or **Write** for each area the key needs: **Services**, **Container Apps**, **Cloud Compute**, **DNS**, **Floating IPs**, **Email**, **Storage**, **Websites and Edge Proxy**, **Billing** and **Support**. A new key starts with **Read-only**, which ticks every **Read** box. **Select all** ticks everything.
5. Optionally, list the addresses the key may be used from in **IP allow-list**: one IPv4 or IPv6 address or CIDR range per line, such as `203.0.113.10` or `2001:db8::/32`. Leave it empty to allow any address.
6. Select **Create API key**.
7. Copy the key from **Copy this key now**. It starts with `ct_`, and Coritan shows it only this once.

Coritan emails you when a key is created.

## Revoke a key

1. On the **API keys** tab, select the bin icon at the end of the key's row.
2. Type the key's label to confirm. A key with no label asks for the word `revoke`.
3. Select **Revoke key**.

> [!CAUTION]
> Revoking deletes the key, and it cannot be undone. To replace a key, create a new one.

## Result

The list shows each key with its label and creation date under **Key**, then **Permissions**, **Allowed from** (`Any address` when it has no allow-list) and **Last used**. **Last used** stays `Never`, because the API does not accept the keys yet.

## Troubleshooting

`Enter a label so you can tell this key apart from your others.`
: The **Label** is empty. Type one.

`Line 2: enter an IP address or a CIDR range.`
: A line in **IP allow-list** is not an address or a range. The message names the line. Fix it or delete it.

`401` from the API with a `ct_` key
: The API does not accept these keys yet. Sign in and use an access token instead, as [Make your first API request](/get-started/first-steps-with-the-api/) shows.

You lost a key
: Coritan cannot show it again. Revoke it and create another.

## Related

- [Make your first API request](/get-started/first-steps-with-the-api/)
- [Authentication](/api/authentication/)
- [Create organization API keys](/organizations/api-keys/)

## With the API

These endpoints take your access token.

Create a key with [`POST /auth/me/api-keys`](/api/reference/client/authentication/#op-post-api-v1-auth-me-api-keys). `label` is required (1–100 characters); `permissions` and `ip_whitelist` are optional lists of strings. The dashboard writes permissions as `area:read` or `area:write`, such as `services:read`.

```bash
curl -X POST https://api.coritan.com/api/v1/auth/me/api-keys \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"label": "CI deploys", "permissions": ["services:read"], "ip_whitelist": ["203.0.113.10"]}'
```

```json
{
  "id": 17,
  "label": "CI deploys",
  "permissions": ["services:read"],
  "ip_whitelist": ["203.0.113.10"],
  "is_active": true,
  "last_used_at": null,
  "created_at": "2026-09-16T10:02:11",
  "raw_key": "ct_..."
}
```

`raw_key` is in this answer only. List your keys, newest first, with [`GET /auth/me/api-keys`](/api/reference/client/authentication/#op-get-api-v1-auth-me-api-keys). It takes `limit` (default 200, at most 500) and returns the same fields without `raw_key`.

Revoke a key with [`DELETE /auth/me/api-keys/{key_id}`](/api/reference/client/authentication/#op-delete-api-v1-auth-me-api-keys-key-id). It answers `{"message": "API key revoked"}`, or `404` `API key not found` for a key that is not yours or no longer exists.

## API

- `GET /api/v1/auth/me/api-keys`: List keys (https://docs.coritan.com/api/reference/client/authentication/#op-get-api-v1-auth-me-api-keys)
- `POST /api/v1/auth/me/api-keys`: Create key (https://docs.coritan.com/api/reference/client/authentication/#op-post-api-v1-auth-me-api-keys)
- `DELETE /api/v1/auth/me/api-keys/{key_id}`: Revoke key (https://docs.coritan.com/api/reference/client/authentication/#op-delete-api-v1-auth-me-api-keys-key-id)