---
title: "Academy Article"
canonical_url: "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys"
locale: en
meta:
"og:title": "Academy Article"
---
[Go to home](https://academy.laioutr.com/en)
- [Cockpit](https://academy.laioutr.com/en/bereiche/cockpit)
- [Team, roles and access](https://academy.laioutr.com/en/leitfaeden/team-roles-and-access)
- [Create and manage API keys](https://academy.laioutr.com/en/artikel/create-and-manage-api-keys)
# Create and manage API keys
API keys are created in the organisation settings under API keys. An organisation key authenticates the CLI and CI/CD, a restricted key gives an external application access to one project's media only.
## Before you start
- Plan
- All plans
- Role
- Role with the apiKeyManagement permission
- Duration
- 6 min
### Prerequisites
- Secret store such as CI variables or a secret manager
- For restricted keys: allowed origins in the project
Last reviewed on October 15, 2026
API keys identify automation to Laioutr without using a personal sign-in. There are two types with separate permissions:
- **Organization** (prefix `orgKey_`): belongs to the organisation and reaches the Laioutr API, the CLI and the npm registry. Scopes are `app:publish`, `project:read-rc`, `project:deploy`, `registry:publish` and `registry:read`. Meant for CI/CD and machines under the organisation's own control.
- **Restricted** (prefix `rstk_`): bound to one project, with the scopes `media:read`, `media:write` and `media:delete`. It only reaches the storefront's public routes and suits applications outside Laioutr, such as an internal tool.
The full key is shown only once, right after creation. After that, the list shows only the prefix, scopes, last use and expiry. Revoking is final.
Laioutr MCP does not need an API key; it connects via OAuth with the personal account.
## Step by step
1. 1 ### Step 1: Open API keys
Open the **API Keys** tab in the organisation settings.
2. 2 ### Step 2: Choose the key type
Click **Create key** and choose **Organization** or **Restricted** under **Key type**. For a restricted key, select the **Project**.
3. 3 ### Step 3: Set name and scopes
Enter a clear **Name** such as CI pipeline and tick only the scopes the application really needs.
4. 4 ### Step 4: Choose expiry
Under **Expiration**, choose no expiry or 30, 60, 90 or 365 days and create the key.
5. 5 ### Step 5: Store the key
Copy the key with **Copy**, store it in the secret store and close with **Done**. It will not be shown again.
6. 6 ### Step 6: Revoke unused keys
Choose **Revoke** in the key's row and confirm. Applications using the key fail from then on.
## Check the result
The new key appears in the list with prefix, type, scopes and **Never** under Last used. After the first call from the CLI or pipeline, the column shows when it was used.
## Frequently asked questions
Which key type fits?
Organisation keys for in-house automation such as CI/CD or the CLI. Restricted keys for third-party or browser applications that should only read or upload one project's media.
The key is lost, what now?
The full key cannot be shown again. Create a new key, swap it in the application and revoke the old one.
Why do the public routes not answer?
For restricted keys, the project must list the calling origin under Allowed origins in its settings.
Does Laioutr MCP need an API key?
No. Laioutr MCP uses OAuth with the personal account; the server URL is shown on the same page when enabled.
## Related
- [The Laioutr CLI: commands and authentication](https://academy.laioutr.com/en/artikel/laioutr-cli-commands-and-authentication)6 min
The Laioutr CLI fetches the project configuration laioutrrc.json, releases app versions to Cockpit and triggers deployments. Install it with pnpm install -g @laioutr/cli@latest or run it without installation via npx.
- [Connect Laioutr MCP to an AI assistant](https://academy.laioutr.com/en/artikel/connect-laioutr-mcp-to-an-ai-assistant)5 min
Laioutr MCP connects Claude, ChatGPT, Cursor or another MCP client to Laioutr projects via OAuth. Once Laioutr has enabled it, signing in with the Laioutr account is enough; no API key is needed.
- [Manage media in Cockpit and Studio](https://academy.laioutr.com/en/artikel/manage-media-in-cockpit-and-studio)5 min
Images, videos and audio files are managed centrally in the Media Library under Content in Cockpit. In Studio, the media picker selects files from every connected library, such as the shop system, and uploads new ones where the library allows it.
- [Assign roles and permissions](https://academy.laioutr.com/en/artikel/assign-roles-and-permissions)6 min
Roles decide what a member can see and do in Cockpit. Besides the built-in roles Owner, Developer, Project Manager and Content Manager, the organisation defines custom roles with selected permissions under Roles and assigns them when inviting.
## Learn it in a lesson
- [Connecting agents: MCP, permissions and LLM key](https://academy.laioutr.com/en/lektionen/developer-connecting-agents)14 min
- [Invite the team, roles and API keys](https://academy.laioutr.com/en/lektionen/go-live-team-roles-and-api-keys)8 min
## [Team, roles and access](https://academy.laioutr.com/en/leitfaeden/team-roles-and-access)
Search this guide
1. [Assign roles and permissions](https://academy.laioutr.com/en/artikel/assign-roles-and-permissions)6 min
2. [Create and manage API keys](https://academy.laioutr.com/en/artikel/create-and-manage-api-keys)6 min
3. [Give access to a single project or environment](https://academy.laioutr.com/en/artikel/give-access-to-one-project-or-environment)5 min
4. [Give the customer service team access](https://academy.laioutr.com/en/artikel/give-your-customer-service-team-access)5 min
5. [View activity and the audit log](https://academy.laioutr.com/en/artikel/view-activity-and-audit-log)5 min
## Structured Data
```json
{
"@context": "https://schema.org",
"@graph": [
{
"@id": "https://academy.laioutr.com/#website",
"@type": "WebSite",
"inLanguage": "en",
"name": "Default",
"url": "https://academy.laioutr.com/",
"translationOfWork": {
"@id": "https://academy.laioutr.com/#website"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#webpage",
"name": "Academy Article",
"url": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys",
"@type": [
"WebPage",
"FAQPage"
],
"breadcrumb": {
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#breadcrumb"
},
"isPartOf": {
"@id": "https://academy.laioutr.com/#website"
},
"mainEntity": [
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/1"
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/2"
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/3"
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/4"
}
],
"potentialAction": [
{
"@type": "ReadAction",
"target": [
"https://academy.laioutr.com/en/artikel/create-and-manage-api-keys"
]
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#breadcrumb",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"name": "Home",
"item": "https://academy.laioutr.com/en",
"position": 1
},
{
"@type": "ListItem",
"name": "Cockpit",
"item": "https://academy.laioutr.com/en/bereiche/cockpit",
"position": 2
},
{
"@type": "ListItem",
"name": "Team, roles and access",
"item": "https://academy.laioutr.com/en/leitfaeden/team-roles-and-access",
"position": 3
},
{
"@type": "ListItem",
"name": "Create and manage API keys",
"item": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys",
"position": 4
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/1",
"@type": "Question",
"inLanguage": "en",
"name": "Which key type fits?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Organisation keys for in-house automation such as CI/CD or the CLI. Restricted keys for third-party or browser applications that should only read or upload one project's media.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/2",
"@type": "Question",
"inLanguage": "en",
"name": "The key is lost, what now?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The full key cannot be shown again. Create a new key, swap it in the application and revoke the old one.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/3",
"@type": "Question",
"inLanguage": "en",
"name": "Why do the public routes not answer?",
"acceptedAnswer": {
"@type": "Answer",
"text": "For restricted keys, the project must list the calling origin under Allowed origins in its settings.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/create-and-manage-api-keys#/schema/question/4",
"@type": "Question",
"inLanguage": "en",
"name": "Does Laioutr MCP need an API key?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. Laioutr MCP uses OAuth with the personal account; the server URL is shown on the same page when enabled.
"
}
}
]
}
```