Skip to main content
API keys are the primary method of authentication for interacting with our APIs. They are organization-based, permission-scoped, and can be secured with IP restrictions.

Create and Manage API Keys

You can generate and manage API keys in your PCCI Dashboard > Settings > API Keys section.

​
Linked to Organizations

API keys are issued at the organization level, not tied to individual users. This means:
  • Any action performed using an API key is attributed to the owning organization.
  • Multiple team members can collaborate using separate keys within the same organization.
  • API keys persist independently of individual user accounts.

​
Unlimited Keys per Organization

Each organization can create any number of API keys, allowing for flexibility across environments, services, or teams. Common usage patterns include:
  • One key per environment (e.g., development, staging, production)
  • One key per integration (e.g., billing automation, analytics)
  • Temporary keys for CI/CD or testing purposes

​
IP Restrictions

To enhance security, API keys can be restricted to specific IP addresses or subnets:
  • Supports IPv4, IPv6, and CIDR notation
  • Requests from unauthorized IPs will be rejected with a 403 Forbidden error
Example entries:
  • 192.168.1.10
  • 2001:0db8::/32
  • 203.0.0.0/8
Use IP allowlists to lock down critical integrations (e.g., production).

​
Scoped Permissions

Each API key can be limited to a specific set of scopes, defining what parts of the API it can access. You’ll be prompted to set these scopes when creating an API Key in the dashboard, if none are specified the API Key will have full permissions.

​
API Scopes Reference

ScopeDescription
api_keys.readView and list API keys associated with your organization.
chats.completionAccess chat completion functionality.
webhooks.createCreate new webhooks for event notifications.
webhooks.readView and list existing webhooks.
webhooks.updateUpdate webhook configurations.
webhooks.deleteDelete webhooks.
webhooks_queue.readView webhook queue data.
webhooks_queue.updateUpdate webhook queue entries.
notifications.readView notifications.
notifications.updateUpdate notifications.
notifications_settings.readView notification settings.
notifications_settings.updateUpdate notification settings.
organizations.createCreate new organizations.
organizations.readView organization information and details.
organizations.updateUpdate organization metadata and settings.
users.readView and list users associated with your organization.
users.updateUpdate metadata of existing users.
users.sessions.readView session data of existing users.
roles.createCreate new roles with specific permissions.
roles.readView and list roles.
roles.updateUpdate existing role configurations.
roles.deleteDelete roles.
tools.executeExecute tools and integrations.
files.encrypted.readRead encrypted files.
files.encrypted.createUpload encrypted files.
files.encrypted.deleteDelete encrypted files.
This allows you to enforce principle of least privilege and isolate permissions per use case.
A request made with a key lacking the required scope will return 403 Forbidden.

​
Best Practices

  • Rotate keys regularly to minimize exposure
  • Use least privilege: only assign required scopes
  • Restrict by IP where possible
  • Avoid sharing keys between environments or teams
For key management, visit your Dashboard > Developers > API Keys. Need help? Contact support or refer to the Authentication Guide.