# API keys

Scoped, project-bound credentials for machines.

> Section: API

## One key, one project, explicit scopes

A key cannot reach across projects. Grant only the scopes the integration uses: db.query.read, db.query.write, blob.read, blob.write, app.read, function.read and the rest.

## One key per integration

Separate keys mean you can revoke one without breaking the others, and the audit log attributes each change to the system that made it.

## Where a key must never go

A key in a browser bundle is a published secret. Browser clients get short-lived tickets instead. In CI, keep the key in the secret store and never pass it as a public build argument.

## Billing gates writes

An inactive managed subscription blocks platform mutations, including through API keys and the CLI. Sign-in and read access remain available so you can resolve the billing problem.