> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys API

> List, inspect, create, update, and revoke project API keys.

Use the API Keys API only for explicit operator workflows. Key operations are sensitive and intentionally hidden from hosted MCP by default.

## Operations

| Operation        | Method and path                                      | Purpose                                             |
| ---------------- | ---------------------------------------------------- | --------------------------------------------------- |
| `apiKeys.list`   | `GET /v1/projects/{project_id}/api-keys`             | List API key metadata for a project.                |
| `apiKeys.get`    | `GET /v1/projects/{project_id}/api-keys/{key_id}`    | Get metadata for one key.                           |
| `apiKeys.create` | `POST /v1/projects/{project_id}/api-keys`            | Create a key with `{ label, scopes, expires_at? }`. |
| `apiKeys.update` | `PATCH /v1/projects/{project_id}/api-keys/{key_id}`  | Update key label or scopes.                         |
| `apiKeys.delete` | `DELETE /v1/projects/{project_id}/api-keys/{key_id}` | Revoke a key.                                       |

`apiKeys.create` can return a secret that is shown once. Never log it, paste it into public artifacts, or include it in agent transcripts beyond the minimum private handoff the operator requested.

## CLI and MCP

Use the REST API or dashboard for key management. Hosted MCP hides API key operations; do not assume `search("apiKeys")` will return runnable operations.

## Agent handoff

```text theme={null}
Manage Squasher API keys only after explicit user confirmation. Verify project id, desired scopes, expiration, and label. Never expose full key secrets in output, and ask before creating, updating scopes, or revoking a key.
```

Related: [Quickstart](/quickstart), [MCP](/integrations/mcp).