# API keys

Your coding tool and the Astris CLI act on your account with an API key. Each key is sent as a bearer token.

## Create a key

[Sign in to the Console](https://api.astris.run/console/sign-in) and open the API keys page. Give the key a name and create it. Astris shows a key only once, when you create it, so copy it now. Astris does not keep the key itself, so it cannot show it again.

Put the key in your coding tool as the [quickstarts](/docs/quickstart/claude-code) show, or give it to the CLI:

```
astris login
```

Do not commit a file that contains the key.

## See which key you use

```
astris whoami
```

It prints the account, the plan and the key name with the first characters of the key. The MCP tool `whoami` gives the same, and the account's next step.

## Revoke a key

On the API keys page, revoke the key. The key stops working at once. This cannot be undone. Then create a new key and put it in your tools.

## Kinds of key

A key you create in the Console can read and change everything on your account. Astris also has two narrower kinds of key:

- A read-only key reads but changes nothing. A change is refused with [read_only_key](/docs/errors/read_only_key).
- A project key reaches one project only. Other projects look empty to it. A request to create a project is refused with [project_scope](/docs/errors/project_scope).

A missing, unknown or revoked key is refused with [unauthorized](/docs/errors/unauthorized).