# API keys

Multiple keys per workspace. UI is only visible when your user/workspace is on the intelligence dogfood allowlist.

## Create

Settings → API keys → Create. Choose a preset or custom scopes:

| Preset | Scopes |
|--------|--------|
| Read-only | workspaces/buckets/files/intelligence/shares/transfers read |
| Upload + read | read + upload + download |
| Agent read-only | buckets/files read + download + agent:run |
| Full access | all scopes |

Optional: restrict to specific `bucketIds`, set expiry.

**The secret is shown once.** Store it securely; only `keyPrefix` is listed later.

## Scopes

`workspaces:read`, `buckets:read|write|delete`, `files:read|write|delete|upload|download`, `intelligence:read|write`, `agent:run`, `shares:read|write`, `transfers:read|write`.

Keys cannot escalate past the creating member's workspace permissions.

## Use with MCP

```json
{
  "mcpServers": {
    "file-rocks": {
      "url": "https://www.file.rocks/api/mcp",
      "headers": { "Authorization": "Bearer fr_live_..." }
    }
  }
}
```

## Revoke

Settings → API keys → Revoke. Revoked keys fail immediately.