API Keys
API keys authenticate programmatic access to Chainlink Platform products, such as the CRE CLI, the ACE APIs, and the CRE Connect API. This page describes how API key permissions work, which permissions are available for each product, and how to create and manage API keys.
How API keys work
An API key is an organization-level credential. When you create an API key, you select the permissions the key has, and the key can act only within those permissions.
- A single API key can include permissions for multiple products. For example, one key can deploy CRE workflows and read ACE reports.
- API key permissions are a subset of all permissions. Some permissions, such as managing members, are available only to organization members through their roles.
- An API key can act only within the permissions you select for it.
- You can give an API key only permissions that your own roles include. When you edit a key, you can keep permissions it already has even if your roles don't include them.
To create and manage API keys, you need a role that includes API key permissions, such as Platform User, Platform Admin, or Owner. See RBAC for the full list of roles.
Available permissions
The following tables list the permissions you can assign to an API key for each product, grouped the same way as the API Scope section of the creation form. Role columns show which member roles include each permission, so you can match a key's access to a role. The Name column shows the label used in the API Scope section of the form. A check mark indicates that the role includes the permission. The Owner role includes every permission for every product. For what each role is for, and for the permissions available only to members, see RBAC.
Chainlink Platform
| Name | Permission | Description | Admin | User |
|---|---|---|---|---|
| Organization: Read | platform:organization:read | View organization information. | ✓ | ✓ |
| Owner address: Read | platform:owner_address:read | View the organization's addresses in the address book. | ✓ | ✓ |
CRE
| Name | Permission | Description | Admin | Developer | Viewer |
|---|---|---|---|---|---|
| Workflow: Read | cre:workflow:read | View workflows. | ✓ | ✓ | ✓ |
| Workflow artifact: Read | cre:workflow:artifact:read | Download workflow artifacts. | ✓ | ✓ | ✓ |
| Workflow artifact: Write | cre:workflow:artifact:write | Upload workflow artifacts, which is required to deploy a workflow. | ✓ | ✓ | |
| Workflow: Write (Private registry) | cre:workflow:write/private_registry | Deploy, pause, activate, and delete workflows in the private registry. | ✓ | ✓ | |
| Owner address linking: Write (CRE) | platform:owner_address:linking:write/cre | Link and unlink workflow owner addresses, which is required to deploy workflows to the onchain registry. | ✓ |
ACE
Policy manager
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Policy manager policy engine: Read | ace:policy_manager:policy_engine:read | Read policy engines. | ✓ | ✓ | ✓ |
| Policy manager policy engine: Write | ace:policy_manager:policy_engine:write | Create and update policy engine. | ✓ | ✓ | |
| Policy manager policy engine archive: Write | ace:policy_manager:policy_engine:archive:write | Archive policy engine (affects everything deployed under it). | ✓ | ||
| Policy manager policy: Read | ace:policy_manager:policy:read | Read policies and data validator instances. | ✓ | ✓ | ✓ |
| Policy manager policy: Write | ace:policy_manager:policy:write | Create and update policy and data validator instances. | ✓ | ✓ | |
| Policy manager policy archive: Write | ace:policy_manager:policy:archive:write | Archive policy and data validator instances. | ✓ | ✓ | |
| Policy manager target: Read | ace:policy_manager:target:read | Read targets and their protections. | ✓ | ✓ | ✓ |
| Policy manager target: Write | ace:policy_manager:target:write | Create and update target and its protections. | ✓ | ✓ | |
| Policy manager target archive: Write | ace:policy_manager:target:archive:write | Archive target and its protections. | ✓ | ✓ | |
| Policy manager target access: Read | ace:policy_manager:target_access:read | Read a target's cross-org evaluation access grants. | ✓ | ||
| Policy manager target access: Write | ace:policy_manager:target_access:write | Grant and revoke cross-org evaluation access to a target. | ✓ | ||
| Policy manager implementation: Read | ace:policy_manager:implementation:read | Read extractors and policy types. | ✓ | ✓ | ✓ |
| Policy manager implementation: Write | ace:policy_manager:implementation:write | Create and update extractor or policy type (updates affect every instance built on it). | ✓ | ✓ | |
| Policy manager implementation archive: Write | ace:policy_manager:implementation:archive:write | Archive extractor or policy type (affects every instance built on it). | ✓ |
Identity manager
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Identity manager registry: Read | ace:identity_manager:registry:read | Read identity and credential registries, and credential types. | ✓ | ✓ | ✓ |
| Identity manager registry: Write | ace:identity_manager:registry:write | Create and update identity or credential registry, and credential types. | ✓ | ✓ | |
| Identity manager registry archive: Write | ace:identity_manager:registry:archive:write | Archive identity or credential registry (affects everything deployed under it). | ✓ | ||
| Identity manager registry access: Read | ace:identity_manager:registry_access:read | Read a registry's cross-org access grants. | ✓ | ||
| Identity manager registry access: Write | ace:identity_manager:registry_access:write | Grant and revoke cross-org read access to a registry. | ✓ | ||
| Identity manager identity: Read | ace:identity_manager:identity:read | Read identities and credentials. | ✓ | ✓ | ✓ |
| Identity manager identity: Write | ace:identity_manager:identity:write | Create and update identity, and assign credentials. | ✓ | ✓ | |
| Identity manager identity archive: Write | ace:identity_manager:identity:archive:write | Archive identity and credentials. | ✓ | ✓ |
Reporting
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Reporting policy: Read | ace:reporting:policy:read | Read the reporting service's policy view. | ✓ | ✓ | ✓ |
| Reporting identity: Read | ace:reporting:identity:read | Read the reporting service's identity view. | ✓ | ✓ | ✓ |
| Reporting target: Read | ace:reporting:target:read | Read the reporting service's target view. | ✓ | ✓ | ✓ |
| Reporting transaction: Read | ace:reporting:transaction:read | Read the reporting service's transaction view. | ✓ | ✓ | ✓ |
| Reporting permit: Read | ace:reporting:permit:read | Read the reporting service's permit view. | ✓ | ✓ | ✓ |
| Reporting registry: Read | ace:reporting:registry:read | Read the reporting service's registry usage view. | ✓ | ✓ | ✓ |
Evaluation
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Evaluation permit: Read | ace:evaluation:permit:read | Read evaluation permits. | ✓ | ✓ | ✓ |
| Evaluation permit: Write | ace:evaluation:permit:write | Create evaluation permit. | ✓ | ✓ |
Core
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Core org config: Read | ace:core:org_config:read | Read organization details. | ✓ | ✓ | ✓ |
| Core network: Read | ace:core:network:read | Read supported networks. | ✓ | ✓ | ✓ |
| Core wallet: Read | ace:core:wallet:read | Read wallets. | ✓ | ✓ | ✓ |
| Core wallet: Write | ace:core:wallet:write | Create wallet. | ✓ |
Active monitoring
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Active monitoring action variable: Read | ace:active_monitoring:action_variable:read | Read action variables. | ✓ | ✓ | ✓ |
| Active monitoring contract group: Read | ace:active_monitoring:contract_group:read | Read contract groups. | ✓ | ✓ | ✓ |
| Active monitoring contract group: Write | ace:active_monitoring:contract_group:write | Create contract groups. | ✓ | ✓ | |
| Active monitoring rule group: Read | ace:active_monitoring:rule_group:read | Read rule groups. | ✓ | ✓ | ✓ |
| Active monitoring rule group: Write | ace:active_monitoring:rule_group:write | Create and update rule groups. | ✓ | ✓ | |
| Active monitoring monitored address: Read | ace:active_monitoring:monitored_address:read | Read monitored addresses. | ✓ | ✓ | ✓ |
| Active monitoring monitored address: Write | ace:active_monitoring:monitored_address:write | Add addresses to the screening watch list. | ✓ | ✓ | |
| Active monitoring screening interval: Read | ace:active_monitoring:screening_interval:read | Read the screening interval. | ✓ | ✓ | ✓ |
| Active monitoring screening interval: Write | ace:active_monitoring:screening_interval:write | Set, remove, start and stop the screening interval. | ✓ | ✓ | |
| Active monitoring decision log: Read | ace:active_monitoring:decision_log:read | Read decision logs. | ✓ | ✓ | ✓ |
| Active monitoring decision log: Write | ace:active_monitoring:decision_log:write | Dismiss and enforce decision logs. | ✓ | ✓ | |
| Active monitoring provider API key: Read | ace:active_monitoring:provider_api_key:read | Read screening-provider API key metadata. | ✓ | ✓ | ✓ |
| Active monitoring provider API key: Write | ace:active_monitoring:provider_api_key:write | Set and remove screening-provider API keys. | ✓ | ✓ |
Administration
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Member role: Write (ACE) | platform:member_role:write/ace | Change members' ACE roles. | ✓ |
CRE Connect
Core
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Network: Read | crec:network:read | Read available blockchain networks. | ✓ | ✓ | ✓ |
| Wallet: Read | crec:wallet:read | Read wallets. | ✓ | ✓ | ✓ |
| Wallet: Write | crec:wallet:write | Create or update wallet. | ✓ | ✓ | |
| Wallet archive: Write | crec:wallet:archive:write | Archive wallet. | ✓ |
Operations
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Operation: Read | crec:operation:read | Read operations and search by initiator/signer/canceller. | ✓ | ✓ | ✓ |
| Operation: Write | crec:operation:write | Create operation (draft or pre-signed). | ✓ | ✓ | |
| Operation signature: Write | crec:operation:signature:write | Sign (finalize) or cancel operation. | ✓ | ✓ |
Channels
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Channel: Read | crec:channel:read | Read channels. | ✓ | ✓ | ✓ |
| Channel: Write | crec:channel:write | Create or update channel. | ✓ | ✓ | |
| Channel archive: Write | crec:channel:archive:write | Archive channel. | ✓ |
Watchers
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Watcher: Read | crec:watcher:read | Read watchers. | ✓ | ✓ | ✓ |
| Watcher: Write | crec:watcher:write | Create or update watcher. | ✓ | ✓ | |
| Watcher archive: Write | crec:watcher:archive:write | Archive watcher. | ✓ |
Queries
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Query: Read | crec:query:read | Read queries. | ✓ | ✓ | ✓ |
| Query: Write | crec:query:write | Create query. | ✓ | ✓ |
Events
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Event: Read | crec:event:read | Read events, run history, and search events. | ✓ | ✓ | ✓ |
Administration
| Name | Permission | Description | Admin | Operator | Viewer |
|---|---|---|---|---|---|
| Member role: Write (CRE Connect) | platform:member_role:write/crec | Change members' CRE Connect roles. | ✓ |
Data Streams
API keys cannot be scoped to Data Streams. Data Streams uses its own authentication with credentials managed in the Data Streams portal. See Data Streams API Authentication.
Creating an API key
To create an API key:
- Sign in to app.chain.link.
- Click your account's icon in the top-right corner, then click Org settings in the dropdown to open the Organization page.
- Click to open the API Keys tab and click Create API Key.
- Enter a name for the key.
- In the API Scope section, select the permissions for the key:
- Each product (Platform, ACE, CRE, and CRE Connect) has its own expandable section. Expand the products the key needs access to.
- Each product has a preset: None, Read, Write, or Custom. Read grants the product's read permissions, Write grants every permission available for that product, and Custom is applied automatically when you change an individual permission. The Chainlink Platform section has no write permissions for API keys, so it offers only None, Read, and Custom.
- Inside a product, each resource (for example, Workflow artifact) has its own None, Read, or Write setting. To turn individual permissions on or off, set the product's preset to Custom; each resource then shows its permissions by action, such as Write (Private registry). The Name column in the tables above matches the resource and action labels in the form.
- You can only select permissions that your own roles include.
- Click Create API Key, then copy the key and click Done.
Managing API keys
The API Keys tab on the Organization page lists your organization's API keys with their name, key ID, author, product access, creation date, and status. Use the Status and Product access filters or the search field to find specific keys.
Click a key's name to open its edit panel. The Scopes tab shows the same permission selection as the creation form: change the presets or individual permissions, then click Save changes. Permissions on the key that your roles don't include are shown locked: you can keep them, but you can't change them. The Actions tab lists the operations you can perform on the key:
- Rename API Key: changes the key's name. The new name is visible to all organization members.
- Rotate Key: generates a new value for the same key. Use this when a key's value may have been exposed.
- Delete API: permanently deletes the API key and its value.
API key security
- Never share your API keys. Each member should use keys with only the permissions they need.
- If a key's value may have been exposed, rotate the key from its Actions tab.
- Review your organization's API keys regularly and delete keys that are no longer needed.
What's next?
- RBAC - Learn about member roles and what each role can do.
- Understanding Organizations - Learn how organizations work on the Chainlink Platform.
- Inviting Team Members - Add members to your organization.