> ## Documentation Index
> Fetch the complete documentation index at: https://gecko.security/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage keys for the Gecko v1 API and MCP server.

API keys authenticate requests to the [Gecko v1 API](/docs/api-reference/introduction)
and can also connect [AI tools](/docs/ai-tools/overview) that don't support OAuth.
Keys are scoped to the team they're created in. Manage them in **Settings** >
**API Keys**.

<Note>
  API keys are available on **Pro and Enterprise** plans.
</Note>

## Create a key

<Steps>
  <Step title="Open API Keys">
    Go to **Settings** > **API Keys** and click **Create API Key**.
  </Step>

  <Step title="Name it">
    Give the key a descriptive name, such as `CI/CD Pipeline` or `Production`.
  </Step>

  <Step title="Copy the key now">
    Gecko shows the full key value **once**, at creation. Copy and store it
    securely; afterward only a masked preview is shown.
  </Step>
</Steps>

<Tip>
  A key can do anything the owner's role allows. For scope-limited access,
  such as an AI tool that should only read findings, connect an OAuth
  agent under **Settings** > **Integrations** instead. See
  [Connect AI tools](/docs/ai-tools/overview).
</Tip>

## Use a key

Send the key either as a bearer token or in the `X-API-Key` header:

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://app.gecko.security/api/v1/scans?limit=10" \
    -H "Authorization: Bearer $GECKO_API_KEY"
  ```

  ```python Python theme={null}
  import requests

  res = requests.get(
      "https://app.gecko.security/api/v1/scans",
      params={"limit": 10},
      headers={"Authorization": "Bearer YOUR_API_KEY"},
  )
  res.raise_for_status()
  print(res.json())
  ```

  ```javascript JavaScript theme={null}
  const res = await fetch(
    "https://app.gecko.security/api/v1/scans?limit=10",
    { headers: { Authorization: `Bearer ${process.env.GECKO_API_KEY}` } },
  );
  const data = await res.json();
  console.log(data);
  ```
</CodeGroup>

Gecko scopes every response to the team attached to the key and checks the
key owner's current role permissions on every request. See the
[API reference](/docs/api-reference/introduction) for endpoints, rate limits, and
examples.

## Manage and revoke

Keys are visible to the whole team. The API Keys table shows each key's name,
masked preview, **who created it**, creation date, and last-used time.
Usage is logged per request, so last-used stays accurate.

Delete a key to revoke it immediately. You can always delete your own keys;
deleting a teammate's requires the `api_keys.manage` permission.

<Warning>
  Deleting a key takes effect right away, including for any AI tools
  connected with it. Rotate by creating the new key first, updating your
  integration, then deleting the old one.
</Warning>