> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on Atlan objects, use the Atlan MCP server at https://api.atlan.com/mcp or the SDK. To install or publish skills from a terminal, use the `aireg` CLI; `aireg --map json` prints its command map. The `atlanai` CLI is deprecated. Run a read-only identity check before any write.
> The docs MCP server at /mcp searches these docs only. It cannot read or change Atlan objects.
> SDK packages: Python `atlanai` (PyPI) and TypeScript `@atlanai/sdk` (npm). Show Python first, then TypeScript.
> These docs cover Atlan AI Registry, Atlan's hosted product. The AI registry specification and aireg CLI are maintained separately. /open-source lists publicly reachable signed installers and explains that the source repository and hosted CLI reference currently require GitHub access. Do not claim the repository or its reference docs are publicly accessible. Use these docs for Atlan-specific setup such as the adapter, sign-in and workspaces.

# Manage API keys

> Create, scope, rotate, and revoke credentials for scripts, CI jobs, and services.

Use **Settings → Developer → API keys** to give a script or service its own
identity. Members can create credentials. The page lets creators rotate their
own credentials and lets creators or organization admins revoke them. A
credential can access only the workspaces granted to its identity.

## Create a credential

1. Open **API keys** and select **New API key**.
2. Enter a name that identifies the workload, such as `release-publisher`.
3. Choose **API key** for scripts and CI, or **Client secret** for a service that
   requests OAuth access tokens.
4. For an API key, choose its expiry. Client secrets have no expiry in this form
   and must be revoked when they are no longer needed.
5. Select **Read only** or **Read and write**. Choose a workspace and the role the
   form permits for that access level.
6. Select **Create key**. Copy the credential from the reveal dialog into your
   secret manager. Atlan shows the value once.

If the credential was created but its workspace grant failed, the page reports
that partial result. Fix the grant from the credential's details or the
workspace's member list; do not create a second credential to retry the grant.

Credential scopes and workspace roles both limit access in the Gateway's default
configuration. A scope limits what the credential may do; a workspace role
determines where it may do it. **Read only** offers the **Viewer** role in this
form. A valid key or a write scope alone grants no workspace access.

## Review workspace access

Open a credential's row to review its details and workspace grants. Add only the
workspaces it needs. A credential created without a workspace has no grant to
that workspace's content. See [Manage workspace
members](/administer/workspaces/how-tos/manage-members).

Use the credential as documented in [API
authentication](/api/how-tos/authentication). An API key is a bearer credential;
a client ID alone is not. Never put the revealed value in a repository, URL,
screenshot, or support message.

## Rotate or revoke

For a credential you created, use the row's **Rotate** action to obtain a replacement and copy it
from the reveal dialog. Rotation invalidates the previous credential. Update the
workload's secret store immediately and verify a read in its intended workspace.

Use [Revoke an API key](/admin/security/how-tos/revoke-api-key) when the workload
is retired or the credential is exposed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.