Manage API Keys

Create, list, protect, and revoke workspace API keys from the terminal with the roboflow api-key command group.

The roboflow api-key command group lets you manage your workspace's API keys from the terminal. It wraps the API key REST endpoints and uses the workspace and credentials from your CLI config (see Install and Set Up the CLI).

The full secret value is shown only when you create a key. Capture it immediately - list/get never reveal it again.

roboflow api-key --help

Command	Description
list	List the workspace's API keys.
get	Show details for one key.
create	Create a new key (prints the secret once).
update	Update a key's name, scopes, or metadata.
protect	Mark a key as protected.
disable	Disable or re-enable a key.
revoke	Permanently revoke a key.
publishable	Print the workspace publishable key.

Add --json (a global flag, before the command) to get machine-readable output for scripting, e.g. roboflow --json api-key list.

List keys

roboflow api-key list
roboflow api-key list --include-disabled --include-folders

Get one key

Keys are addressed by their keyId (the non-secret handle shown in list):

roboflow api-key get <key_id>

Create a key

# Inherits the calling credential's scopes (a full-access key when the caller is full-access)
roboflow api-key create "my-app"

# Scoped key (repeat --scope; requires Advanced API Keys)
roboflow api-key create "inference-only" --scope model:infer

# Role preset - grant an RBAC role's scopes (built-in or custom role name);
# composable with explicit scopes. role:owner means full access.
roboflow api-key create "reviewer-bot" --scope role:reviewer --scope model:infer

# Folder-scoped + protected
roboflow api-key create "edge-device" --folder <folder_id> --protected

# Attach metadata (repeat --metadata; requires Advanced API Keys)
roboflow api-key create "ci-key" --metadata team=vision --metadata env=prod

The secret is printed once. To capture it in a script, use --json and pipe to jq:

roboflow --json api-key create "ci-key" | jq -r .key > .env.key

--scope, --folder, and --metadata require the Advanced API Keys plan feature, and you can only grant abilities the credential running the command already has.

Update a key

# Rename
roboflow api-key update <key_id> --name "renamed-key"

# Replace the key's scopes (repeat --scope)
roboflow api-key update <key_id> --scope model:infer --scope project:read

# Replace the key's metadata (repeat --metadata)
roboflow api-key update <key_id> --metadata team=vision --metadata env=prod

--scope replaces the key's existing scopes with exactly the set you pass, and --metadata replaces the key's metadata. Send --name on its own to rename without touching either.

Changing scopes or metadata requires the Advanced API Keys plan feature (renaming with --name does not). As with create, you can only grant scopes the credential running the command already holds.

Protect / unprotect a key

roboflow api-key protect <key_id>

A protected key cannot be disabled or revoked via the CLI, API, or MCP. Unprotecting can only be done in the dashboard - there is intentionally no unprotect command, so an automated workflow can't remove the safety and revoke a production key in one step.

Disable / re-enable a key

roboflow api-key disable <key_id>            # disable
roboflow api-key disable <key_id> --enable   # re-enable

Disabled keys are rejected by the API but can be re-enabled. A protected key cannot be disabled.

roboflow api-key disable (and re-enabling with --enable) requires the Advanced API Keys plan feature, the same as scoped create with --scope/--folder. This matches the REST API.

Revoke a key

roboflow api-key revoke <key_id>          # prompts for confirmation
roboflow api-key revoke <key_id> --yes    # skip the prompt (for scripts)

Revoking is permanent. A protected key cannot be revoked from the CLI - unprotect it in the dashboard first.

Get the publishable key

roboflow api-key publishable
roboflow --json api-key publishable | jq -r .publishableKey

The publishable key (rf_<workspaceId>) is non-secret and safe to embed in browser / inferencejs code. It is inference-only and cannot be created or revoked. See Manage API Keys (REST) for details.