---
title: "Create and manage Keep API keys | Keep"
description: "Create a personal Keep key, give each agent a named connection, or limit read-only access to Items with a tag or collection."
canonical: "https://keep.md/docs/api-keys"
language: "en"
---

# Create and manage API keys

Create a personal Keep key, give each agent a named connection, or limit read-only access to Items with a tag or collection.

Keep has three credential types. Use the type with the least access that your client needs.

| Type | Use |
| --- | --- |
| Personal key | Your own CLI, scripts, and account administration |
| Connected client | One named AI agent or other read-and-write client |
| Read-only key | A client that only reads Items and related library data |

Manage keys in [Connection settings](https://app.keep.md/settings/connections#api).

## Create a personal key

A personal key has full access to your Keep account.

1.  Open **Settings**.
2.  Open **Connections**.
3.  Find **API and agents**.
4.  Create the personal key.
5.  Copy the key.

Keep shows the full value once. Store it in a password manager or secrets manager.

Send it as a Bearer token:

```
curl https://keep.md/api/me \
  -H "Authorization: Bearer $KEEP_API_KEY"
```

Roll the personal key when you need a new value. The previous personal key stops working at once. Connected clients and read-only keys stay active.

## Connect an agent

Give each agent its own named connection. The trusted connection name appears in Note revision history.

```
keep login claude-code
keep login claude-desktop
keep login codex
```

Each command shows a short code and opens Keep in your browser. Approve the requested access there, and Keep stores the new credential for that client.

A connected client can read and write:

-   Items
-   Notes
-   tags
-   collections
-   Projects
-   highlights

It can also read account details. It cannot create or revoke credentials. It cannot manage webhooks.

See [Connected agents](https://keep.md/docs/agents) for the shared-library and conflict rules.

## Revoke a connected client

Use Connection settings, or run:

```
keep auth remove codex
```

Revocation takes effect at once. It does not affect other clients or remove the Notes and revisions created by that client.

## Create a read-only key

A read-only key can read Items, tags, collections, Projects, and highlights. It cannot access Notes. It cannot save, update, archive, or delete content.

Choose one scope:

-   all Items
-   Items with one tag
-   Items in one collection

1.  Open **Settings**.
2.  Open **Connections**.
3.  Find **API and agents**.
4.  Select **New read-only key**.
5.  Choose the scope.
6.  Enter an optional name.
7.  Create the key.
8.  Copy the key.

Resource-scoped keys cannot access Notes. Use a connected client when an agent must work with Notes.

## Roll or revoke a read-only key

Roll a key to replace its secret without changing its name or scope. Revoke a key to remove its access. Both actions take effect at once.

## Use a key with the CLI

Ordinary CLI use does not need a key. Run `keep login` to sign in through your browser instead.

Keys are for scripts, servers, and integrations. Store one for normal CLI use:

```
keep key YOUR_API_KEY
```

Use one key for one command with `--key`, or set `KEEP_API_KEY` in the current environment. Use `--client <name>` to select a named local connection.

## Protect every key

-   Treat a key like a password.
-   Do not put a key in source control.
-   Use environment variables or a secrets manager.
-   Give each client a separate connection.
-   Revoke a key when it might be exposed.
-   Use read-only access when write access is not required.

See the [API reference](https://keep.md/docs/api) and [CLI guide](https://keep.md/docs/cli) for request examples.