> ## Documentation Index
> Fetch the complete documentation index at: https://keyflare.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys & Access Control

> Manage user and system API keys

Keyflare uses API keys for authentication. There are two types with different access levels.

# Key Types

|             | User Key           | System Key                    |
| ----------- | ------------------ | ----------------------------- |
| **Prefix**  | `kfl_user_*`       | `kfl_sys_*`                   |
| **Access**  | Full admin         | Scoped to project:environment |
| **Use for** | Developers, admins | CI/CD, deployment scripts     |

## User Email Tracking

When a key is created via the CLI, the Cloudflare account email of the creator is automatically recorded (via `wrangler whoami`). This is shown in the `EMAIL` column of `kfl keys list`. Keys created without a detectable email show `-`.

## User Keys (`kfl_user_*`)

* **Full admin access** to everything
* Can manage all projects, environments, secrets, and other API keys
* No scoping required — access to all resources
* Use for: developers, admins, backup keys

## System Keys (`kfl_sys_*`)

* **Scoped access** to specific project:environment pairs
* Can only read or write secrets within their scope
* Cannot create projects, environments, or other keys
* Use for: CI/CD pipelines, deployment scripts, runtime services

## Permission Levels

|                              | Read Secrets | Write Secrets | Manage Projects | Manage Keys |
| ---------------------------- | :----------: | :-----------: | :-------------: | :---------: |
| **User key**                 |       ✅      |       ✅       |        ✅        |      ✅      |
| **System key** — `read`      |  ✅ (scoped)  |       ❌       |        ❌        |      ❌      |
| **System key** — `readwrite` |  ✅ (scoped)  |   ✅ (scoped)  |        ❌        |      ❌      |

# Create API Keys

## User Key

```bash theme={null}
kfl keys create --type user --label "backup-admin"
# Output: kfl_user_b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7
```

<Warning>
  The full key is shown **only once**. Save it securely — it cannot be retrieved again.
</Warning>

## System Key

System keys require `--scope` and `--permission` flags:

```bash theme={null}
# Read-only access to production
kfl keys create --type system \
  --label "github-actions-prod" \
  --scope "my-api:production" \
  --permission read

# Read-write access to all environments in a project
kfl keys create --type system \
  --label "dev-script" \
  --scope "my-api:*" \
  --permission readwrite

# Multiple scopes
kfl keys create --type system \
  --label "staging-deployer" \
  --scope "my-api:staging" \
  --scope "frontend:staging" \
  --scope "worker:staging" \
  --permission readwrite
```

<Note>
  The `*` wildcard must be quoted to prevent shell expansion:

  ```bash theme={null}
  # Correct
  kfl keys create --type system --scope "my-api:*" --permission read

  # Wrong (Zsh error: "no matches found")
  kfl keys create --type system --scope "my-api:*" --permission read
  ```
</Note>

## Scope Format

Scopes follow the format `project:environment`:

| Scope               | Meaning                               |
| ------------------- | ------------------------------------- |
| `my-api:production` | Access to production environment only |
| `my-api:staging`    | Access to staging environment only    |
| `my-api:*`          | Access to ALL environments in my-api  |

# List Keys

```bash theme={null}
kfl keys list
```

Output:

```text theme={null}
PREFIX          TYPE    LABEL              EMAIL                  PERMISSION  SCOPES               CREATED
kfl_user_a1b2   user    bootstrap          alice@example.com      full        *                    2024-01-15
kfl_user_b2c3   user    backup-admin       bob@example.com        full        *                    2024-01-16
kfl_sys_c3d4    system  github-actions     alice@example.com      read        my-api:production    2024-01-16
kfl_sys_d4e5    system  dev-script         -                      readwrite   my-api:*             2024-01-17
```

# Update System Keys

Update scopes and permissions for an existing system key:

```bash theme={null}
# Add staging access (must include ALL scopes)
kfl keys put kfl_sys_c3d4 \
  --scope "my-api:production" \
  --scope "my-api:staging" \
  --permission read
```

<Note>
  `kfl keys put` **replaces all existing scopes** with the new set. Copy current scopes from `kfl keys list` and modify as needed.
</Note>

# Revoke Keys

```bash theme={null}
kfl keys revoke kfl_sys_c3d4
```

Revocation is instant — the key can no longer authenticate.

<h2 noAnchor>Next Steps</h2>

<CardGroup cols={2}>
  <Card href="/guides/using-secrets" title="Using Secrets">
    Inject secrets into CI/CD pipelines and runtime processes.
  </Card>

  <Card href="/guides/security-and-backup" title="Security & Backup">
    Back up your master key and define your recovery strategy.
  </Card>
</CardGroup>