> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/developer/command-line-interface/manage-api-keys.md).

# Manage API Keys

The `roboflow api-key` command group lets you manage your workspace's API keys from the terminal. It wraps the [API key REST endpoints](/developer/rest-api/manage-api-keys.md) and uses the workspace and credentials from your CLI config (see [Install and Set Up the CLI](/developer/command-line-interface/install-and-set-up-the-cli.md)).

{% hint style="info" %}
The full secret value is shown **only** when you create a key. Capture it immediately - list/get never reveal it again.
{% endhint %}

```bash
roboflow api-key --help
```

| Command       | Description                                |
| ------------- | ------------------------------------------ |
| `list`        | List the workspace's API keys.             |
| `get`         | Show details for one key.                  |
| `create`      | Create a new key (prints the secret once). |
| `update`      | Update a key's name, scopes, or metadata.  |
| `protect`     | Mark a key as protected.                   |
| `disable`     | Disable or re-enable a key.                |
| `revoke`      | Permanently revoke a key.                  |
| `publishable` | Print the workspace publishable key.       |

Add `--json` (a global flag, before the command) to get machine-readable output for scripting, e.g. `roboflow --json api-key list`.

## List keys

```bash
roboflow api-key list
roboflow api-key list --include-disabled --include-folders
```

## Get one key

Keys are addressed by their `keyId` (the non-secret handle shown in `list`):

```bash
roboflow api-key get <key_id>
```

## Create a key

```bash
# Inherits the calling credential's scopes (a full-access key when the caller is full-access)
roboflow api-key create "my-app"

# Scoped key (repeat --scope; requires Advanced API Keys)
roboflow api-key create "inference-only" --scope model:infer

# Role preset - grant an RBAC role's scopes (built-in or custom role name);
# composable with explicit scopes. role:owner means full access.
roboflow api-key create "reviewer-bot" --scope role:reviewer --scope model:infer

# Folder-scoped + protected
roboflow api-key create "edge-device" --folder <folder_id> --protected

# Attach metadata (repeat --metadata; requires Advanced API Keys)
roboflow api-key create "ci-key" --metadata team=vision --metadata env=prod
```

The secret is printed once. To capture it in a script, use `--json` and pipe to `jq`:

```bash
roboflow --json api-key create "ci-key" | jq -r .key > .env.key
```

{% hint style="warning" %}
`--scope`, `--folder`, and `--metadata` require the Advanced API Keys plan feature, and you can only grant abilities the credential running the command already has.
{% endhint %}

## Update a key

```bash
# Rename
roboflow api-key update <key_id> --name "renamed-key"

# Replace the key's scopes (repeat --scope)
roboflow api-key update <key_id> --scope model:infer --scope project:read

# Replace the key's metadata (repeat --metadata)
roboflow api-key update <key_id> --metadata team=vision --metadata env=prod
```

`--scope` **replaces** the key's existing scopes with exactly the set you pass, and `--metadata` replaces the key's metadata. Send `--name` on its own to rename without touching either.

{% hint style="warning" %}
Changing scopes or metadata requires the **Advanced API Keys** plan feature (renaming with `--name` does not). As with `create`, you can only grant scopes the credential running the command already holds.
{% endhint %}

## Protect / unprotect a key

```bash
roboflow api-key protect <key_id>
```

A protected key cannot be disabled or revoked via the CLI, API, or MCP. **Unprotecting can only be done in the** [**dashboard**](https://app.roboflow.com/settings/api) - there is intentionally no `unprotect` command, so an automated workflow can't remove the safety and revoke a production key in one step.

## Disable / re-enable a key

```bash
roboflow api-key disable <key_id>            # disable
roboflow api-key disable <key_id> --enable   # re-enable
```

Disabled keys are rejected by the API but can be re-enabled. A protected key cannot be disabled.

{% hint style="warning" %}
`roboflow api-key disable` (and re-enabling with `--enable`) requires the **Advanced API Keys** plan feature, the same as scoped `create` with `--scope`/`--folder`. This matches the [REST API](/developer/rest-api/manage-api-keys.md#update-an-api-key).
{% endhint %}

## Revoke a key

```bash
roboflow api-key revoke <key_id>          # prompts for confirmation
roboflow api-key revoke <key_id> --yes    # skip the prompt (for scripts)
```

Revoking is permanent. A protected key cannot be revoked from the CLI - unprotect it in the dashboard first.

## Get the publishable key

```bash
roboflow api-key publishable
roboflow --json api-key publishable | jq -r .publishableKey
```

The publishable key (`rf_<workspaceId>`) is non-secret and safe to embed in browser / [inferencejs](https://docs.roboflow.com/deploy/web-browser) code. It is inference-only and cannot be created or revoked. See [Manage API Keys (REST)](/developer/rest-api/manage-api-keys.md#the-publishable-key) for details.