# API keys and permissions

Create, store, rotate, and revoke API keys; select permissions for a project.

## Keys belong to projects
An API key is not your login password and does not grant every permission. Check its project and choose scopes for the task.

## Choose scopes
| Task | Scope |
| --- | --- |
| Render, poll status and download through the render API | `template:render` |
| Read project MCP | `mcp:read` |
| Edit through project MCP | `mcp:read` and `mcp:write` |

A render key is not universal access to management APIs; many app operations require a signed-in session.

## Create and store
Create a key in API Keys, select permissions and copy the revealed secret. Store it in backend environment variables or an appropriate secret store. Do not expose it in frontend code, Git or screenshots.

```text
ApiKey: <YOUR_API_KEY>
```

## Rotate or revoke
Rotate and update clients deliberately. Revoke unused or exposed credentials and verify affected integrations. For authentication failures, inspect header, scope and project before widening permissions.