> ## Documentation Index
> Fetch the complete documentation index at: https://docs.planeconnection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Manage API Keys

> Create, rotate, and revoke API keys for programmatic access to your PlaneConnection workspace data.

This guide explains how to create and manage API keys that allow external applications to access your workspace data programmatically.

<Warning>
  This feature requires **administrator** or **workspace owner** permissions. Changes made here
  affect all users in your workspace.
</Warning>

<Info>
  **Who should read this:** Workspace administrators and developers who need to integrate
  PlaneConnection with external systems.

  **Prerequisites:** Admin or Account Owner role. API key management must be enabled for your
  workspace.
</Info>

## When to use API keys

API keys provide programmatic access to your workspace data through the PlaneConnection API. Common use cases include:

* Syncing trip data with your scheduling software
* Pulling safety report data into external dashboards
* Automating invoice creation from your accounting system
* Feeding fleet status into your company website

## Create an API key

<Steps>
  ### Navigate to API key settings

  Go to **Settings > API Keys**. This page lists all active and revoked API keys for your workspace.

  ### Click New API Key

  Click the **New API Key** button at the top of the page.

  ### Configure the key

  | Field           | Description                                                                                                |
  | --------------- | ---------------------------------------------------------------------------------------------------------- |
  | **Name**        | A descriptive name (e.g., "QuickBooks Integration" or "Fleet Dashboard").                                  |
  | **Permissions** | Select which API scopes this key can access (read-only, read-write, or specific modules).                  |
  | **Expiration**  | Set an expiration date or choose "No expiration." Keys with expiration dates are recommended for security. |

  ### Copy the key

  After creation, the full API key is displayed **once**. Copy it immediately and store it securely. You will not be able to view the full key again.
</Steps>

<Warning>
  Treat API keys like passwords. Never commit them to version control, share them in plain text, or
  include them in client-side code. If a key is compromised, revoke it immediately and create a new
  one.
</Warning>

## Rotate an API key

To replace an existing key without downtime:

<Steps>
  ### Create a new key

  Follow the creation steps above, giving the new key the same permissions as the key you are replacing.

  ### Update your integration

  Update the external application to use the new API key.

  ### Verify the integration

  Confirm the external application works with the new key.

  ### Revoke the old key

  Once the new key is confirmed working, revoke the old key (see below).
</Steps>

## Revoke an API key

1. Navigate to **Settings > API Keys**.
2. Find the key you want to revoke.
3. Click the **Revoke** action on the key row.
4. Confirm the revocation.

Revoked keys stop working immediately. Any application using the revoked key will receive `401 Unauthorized` responses.

<Info>
  Revoked keys remain visible in the key list with a **Revoked** status for audit trail purposes.
  They cannot be re-activated -- create a new key instead.
</Info>

## API key best practices

| Practice                   | Why                                                           |
| -------------------------- | ------------------------------------------------------------- |
| Use descriptive names      | Identify which integration each key belongs to at a glance.   |
| Set expiration dates       | Limits damage from compromised keys.                          |
| Use minimum permissions    | Only grant the scopes the integration actually needs.         |
| Rotate keys periodically   | Replace keys every 90 days as a security hygiene practice.    |
| Monitor usage in audit log | Review **Settings > Audit Log** for unusual API key activity. |

## Related

<CardGroup cols={2}>
  <Card title="API Overview" href="/en/reference/api/overview">
    API endpoints and usage documentation.
  </Card>

  <Card title="API Authentication" href="/en/reference/api/authentication">
    How to authenticate API requests.
  </Card>

  <Card title="Configure Webhooks" href="/en/how-to/admin/configure-webhooks">
    Receive real-time event notifications.
  </Card>

  <Card title="Manage Security" href="/en/how-to/admin/manage-security">
    Broader workspace security settings.
  </Card>
</CardGroup>