API Keys
API keys authenticate programmatic access to Chainlink Platform products, such as the CRE CLI, the ACE APIs, and the CRE Connect API. This page describes how API key permissions work, which permissions are available for each product, and how to create and manage API keys.
How API keys work
An API key is an organization-level credential. When you create an API key, you select the permissions the key has, and the key can act only within those permissions.
- A single API key can include permissions for multiple products. For example, one key can deploy CRE workflows and read ACE reports.
- API key permissions are a subset of all permissions. Some permissions, such as managing members or billing, are available only to organization members through their roles.
- An API key can act only within the permissions you select for it.
- You can give an API key only permissions that your own roles include. When you edit a key, you can keep permissions it already has even if your roles don't include them.
To create and manage API keys, you need a role that includes API key permissions, such as Platform User, Platform Admin, or Owner. See RBAC for the full list of roles.
Available permissions
The following tables list the permissions you can assign to an API key for each product, grouped the same way as the API Scope section of the creation form. Role columns show which member roles include each permission, so you can match a key's access to a role. A check mark indicates that the role includes the permission. The Owner role includes every permission for every product. For what each role is for, and for the permissions available only to members, see RBAC.
Chainlink Platform
| Permission | Description | Admin | User |
|---|---|---|---|
platform:organization:read | View organization information. | ✓ | ✓ |
platform:owner_address:read | View the organization's addresses in the address book. | ✓ | ✓ |
CRE
| Permission | Description | Admin | Developer | Viewer |
|---|---|---|---|---|
cre:workflow:read | View workflows. | ✓ | ✓ | ✓ |
cre:workflow:artifact:read | Download workflow artifacts. | ✓ | ✓ | ✓ |
cre:workflow:artifact:write | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | |
cre:workflow:write/private_registry | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | |
platform:owner_address:linking:write/cre | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ |
ACE
Policy manager
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:policy_manager:policy_engine:read | Read policy engines. | ✓ | ✓ | ✓ |
ace:policy_manager:policy_engine:write | Create and update policy engine. | ✓ | ✓ | |
ace:policy_manager:policy_engine:archive:write | Archive policy engine (affects everything deployed under it). | ✓ | ||
ace:policy_manager:policy:read | Read policies and data validator instances. | ✓ | ✓ | ✓ |
ace:policy_manager:policy:write | Create and update policy and data validator instances. | ✓ | ✓ | |
ace:policy_manager:policy:archive:write | Archive policy and data validator instances. | ✓ | ✓ | |
ace:policy_manager:target:read | Read targets and their protections. | ✓ | ✓ | ✓ |
ace:policy_manager:target:write | Create and update target and its protections. | ✓ | ✓ | |
ace:policy_manager:target:archive:write | Archive target and its protections. | ✓ | ✓ | |
ace:policy_manager:target_access:read | Read a target's cross-org evaluation access grants. | ✓ | ||
ace:policy_manager:target_access:write | Grant and revoke cross-org evaluation access to a target. | ✓ | ||
ace:policy_manager:implementation:read | Read extractors and policy types. | ✓ | ✓ | ✓ |
ace:policy_manager:implementation:write | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | |
ace:policy_manager:implementation:archive:write | Archive extractor or policy type (affects every instance built on it). | ✓ |
Identity manager
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:identity_manager:registry:read | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ |
ace:identity_manager:registry:write | Create and update identity or credential registry, and credential types. | ✓ | ✓ | |
ace:identity_manager:registry:archive:write | Archive identity or credential registry (affects everything deployed under it). | ✓ | ||
ace:identity_manager:registry_access:read | Read a registry's cross-org access grants. | ✓ | ||
ace:identity_manager:registry_access:write | Grant and revoke cross-org read access to a registry. | ✓ | ||
ace:identity_manager:identity:read | Read identities and credentials. | ✓ | ✓ | ✓ |
ace:identity_manager:identity:write | Create and update identity, and assign credentials. | ✓ | ✓ | |
ace:identity_manager:identity:archive:write | Archive identity and credentials. | ✓ | ✓ |
Reporting
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:reporting:policy:read | Read the reporting service's policy view. | ✓ | ✓ | ✓ |
ace:reporting:identity:read | Read the reporting service's identity view. | ✓ | ✓ | ✓ |
ace:reporting:target:read | Read the reporting service's target view. | ✓ | ✓ | ✓ |
ace:reporting:transaction:read | Read the reporting service's transaction view. | ✓ | ✓ | ✓ |
ace:reporting:permit:read | Read the reporting service's permit view. | ✓ | ✓ | ✓ |
ace:reporting:registry:read | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ |
Evaluation
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:evaluation:permit:read | Read evaluation permits. | ✓ | ✓ | ✓ |
ace:evaluation:permit:write | Create evaluation permit. | ✓ | ✓ |
Core
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:core:org_config:read | Read organization details. | ✓ | ✓ | ✓ |
ace:core:network:read | Read supported networks. | ✓ | ✓ | ✓ |
ace:core:wallet:read | Read wallets. | ✓ | ✓ | ✓ |
ace:core:wallet:write | Create wallet. | ✓ |
Active monitoring
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
ace:active_monitoring:action_variable:read | Read action variables. | ✓ | ✓ | ✓ |
ace:active_monitoring:contract_group:read | Read contract groups. | ✓ | ✓ | ✓ |
ace:active_monitoring:contract_group:write | Create contract groups. | ✓ | ✓ | |
ace:active_monitoring:rule_group:read | Read rule groups. | ✓ | ✓ | ✓ |
ace:active_monitoring:rule_group:write | Create and update rule groups. | ✓ | ✓ | |
ace:active_monitoring:monitored_address:read | Read monitored addresses. | ✓ | ✓ | ✓ |
ace:active_monitoring:monitored_address:write | Add addresses to the screening watch list. | ✓ | ✓ | |
ace:active_monitoring:screening_interval:read | Read the screening interval. | ✓ | ✓ | ✓ |
ace:active_monitoring:screening_interval:write | Set, remove, start and stop the screening interval. | ✓ | ✓ | |
ace:active_monitoring:decision_log:read | Read decision logs. | ✓ | ✓ | ✓ |
ace:active_monitoring:decision_log:write | Dismiss and enforce decision logs. | ✓ | ✓ | |
ace:active_monitoring:provider_api_key:read | Read screening-provider API key metadata. | ✓ | ✓ | ✓ |
ace:active_monitoring:provider_api_key:write | Set and remove screening-provider API keys. | ✓ | ✓ |
Administration
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
platform:member_role:write/ace | Change members' ACE roles. | ✓ |
CRE Connect
Core
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:network:read | Read available blockchain networks. | ✓ | ✓ | ✓ |
crec:wallet:read | Read wallets. | ✓ | ✓ | ✓ |
crec:wallet:write | Create or update wallet. | ✓ | ✓ | |
crec:wallet:archive:write | Archive wallet. | ✓ |
Operations
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:operation:read | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ |
crec:operation:write | Create operation (draft or pre-signed). | ✓ | ✓ | |
crec:operation:signature:write | Sign (finalize) or cancel operation. | ✓ | ✓ |
Channels
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:channel:read | Read channels. | ✓ | ✓ | ✓ |
crec:channel:write | Create or update channel. | ✓ | ✓ | |
crec:channel:archive:write | Archive channel. | ✓ |
Watchers
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:watcher:read | Read watchers. | ✓ | ✓ | ✓ |
crec:watcher:write | Create or update watcher. | ✓ | ✓ | |
crec:watcher:archive:write | Archive watcher. | ✓ |
Queries
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:query:read | Read queries. | ✓ | ✓ | ✓ |
crec:query:write | Create query. | ✓ | ✓ |
Events
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
crec:event:read | Read events, run history, and search events. | ✓ | ✓ | ✓ |
Administration
| Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|
platform:member_role:write/crec | Change members' CRE Connect roles. | ✓ |
Data Streams
API keys cannot be scoped to Data Streams. Data Streams uses its own authentication with credentials managed in the Data Streams portal. See Data Streams API Authentication.
Creating an API key
To create an API key:
- Sign in to app.chain.link.
- Click your account's icon in the top-right corner, then click Org settings in the dropdown to open the Organization page.
- Click to open the API Keys tab and click Create API Key.
- Enter a name for the key.
- In the API Scope section, select the permissions for the key:
- Each product (Platform, ACE, CRE, and CRE Connect) has its own expandable section. Expand the products the key needs access to.
- Each product has a preset: None, Read, All, or Custom. Read grants the product's read permissions, All grants every permission available for that product, and Custom is applied automatically when you change any individual permission. The Chainlink Platform section offers only None, Read, and Custom.
- To grant individual permissions instead of a preset, set each permission group to None, Read, or All. Some groups offer only a subset of these options.
- Click Create API Key, then copy the key and click Done.
Managing API keys
The API Keys tab on the Organization page lists your organization's API keys with their name, key ID, author, product access, creation date, and status. Use the Status and Product access filters or the search field to find specific keys.
Click a key's name to open its edit panel. The Scopes tab shows the same permission selection as the creation form: change the presets or individual permissions, then click Save changes. The Actions tab lists the operations you can perform on the key:
- Rename API Key: changes the key's name. The new name is visible to all organization members.
- Rotate Key: generates a new value for the same key. Use this when a key's value may have been exposed.
- Delete API: permanently deletes the API key and its value.
API key security
- Never share your API keys. Each member should use keys with only the permissions they need.
- If a key's value may have been exposed, rotate the key from its Actions tab.
- Review your organization's API keys regularly and delete keys that are no longer needed.
What's next?
- RBAC - Learn about member roles and what each role can do.
- Understanding Organizations - Learn how organizations work on the Chainlink Platform.
- Inviting Team Members - Add members to your organization.