# API keys and agent access (/docs/teams-and-billing/management-keys)



Create a key in **Settings → API keys**. Each key belongs to a team and a creator account. Its scopes, expiry, revocation status and the creator's current membership and role are checked by the server.

New keys expire after **24 hours by default**, with a maximum lifetime of **30 days**. A delegated key cannot outlive its source key or grant scopes its caller lacks.

## Pick scopes [#pick-scopes]

| Scope                           | Purpose                                                              |
| ------------------------------- | -------------------------------------------------------------------- |
| `teams:read`                    | Read team identity                                                   |
| `ci:read`                       | Read jobs, logs, runners and CI summaries                            |
| `billing:read`                  | Read wallet, holds, costs and budget, subject to role                |
| `ci:write`                      | Change runner settings or disconnect GitHub, subject to role         |
| `billing:write`                 | Create payment handoffs and change billing settings, subject to role |
| `members:read`, `members:write` | Read or manage membership                                            |
| `keys:read`, `keys:write`       | Read key metadata or manage keys                                     |
| `teams:write`, `audit:read`     | Edit team details or read audit events                               |

Start an agent with `teams:read` and `ci:read`. Add financial visibility only when needed. Scope names are explicit; there is no wildcard that an agent should request by default.

## Store and revoke [#store-and-revoke]

A newly created secret is shown once. Enter it through the [hidden CLI login prompt](/docs/agents/cli). Do not paste it into chat, put it in command arguments or commit it in a repository.

`berrybox logout` removes the local credentials file. It does not revoke copies elsewhere. Revoke the key in the dashboard to stop all copies. Rotation creates a new generation; update your local credentials deliberately.

For CLI key creation or rotation, save the returned secret using `--output-token FILE`. Secret-returning operations are excluded from MCP.

## Limits still apply [#limits-still-apply]

A short-lived key limits API authority. It does not bypass team roles, API rate limits, prepaid credit, runtime reservations or job concurrency. Removing a team member also removes their ability to use keys that depend on that membership.