---
title: "Personal API keys | Logdash Docs"
description: "Create a key that reads your logs, metrics, monitors and analytics from scripts and coding agents, limited to the scopes and domains you pick."
url: https://logdash.io/docs/api-keys
---

# Personal API keys

Create a key that reads your logs, metrics, monitors and analytics from scripts and coding agents, limited to the scopes and domains you pick.

A personal API key acts as you outside the browser: in a script, a CI job or a coding agent. You decide what it can read or change, which domains it reaches and when it expires. It is a different key from the ingest key your apps send logs with. See [Keys and IDs](https://logdash.io/docs/concepts#keys-and-ids).

##  Create a key

1. **Open API keys** Open the account menu at the bottom of the sidebar, choose **API keys** and press **New key**.
2. **Name it** Enter a **Label** that says where the key lives, such as `CI release job` or `My laptop`. You see it in the list of keys later.
3. **Pick scopes** Under **Scopes**, give each area the least access the job needs. Every area starts at **Read**, except **Account**.
4. **Pick access** Under **Access**, choose **Everything**, a set of **Domains**, or a set of apps under **Services**.
5. **Pick an expiry** Choose **30 days**, **90 days**, **1 year** or **No expiration**, and press **Create key**.
6. **Copy the key** Logdash shows the key once. Copy it into your secret store or an environment variable, such as `LOGDASH_PERSONAL_KEY`.

Logdash keeps only a hash of the key. If you lose it, revoke it and create a new one.

##  Use a key

Send the key in the `Authorization` header of every request. To check a key and see what it can do, call `whoami`:

```bash
curl https://api.logdash.io/personal-api-keys/whoami \
  -H "Authorization: Bearer $LOGDASH_PERSONAL_KEY"
```

 Response 

```json
{
  "userId": "6650f1c2a3b4c5d6e7f80912",
  "scopes": [
    { "resource": "logs", "action": "read" },
    { "resource": "monitors", "action": "read" }
  ],
  "access": { "kind": "clusters", "ids": ["6650f1c2a3b4c5d6e7f80a01"] }
}
```

The [HTTP API](https://logdash.io/docs/api#read-your-data) lists what you can read with it, and the [MCP server](https://logdash.io/docs/mcp) takes it too.

##  Scopes

Each scope gives one area of your data an access level. A higher level includes the ones below it, so **Write** can also read.

| Scope         | Levels              | What it allows                                                                                                                   |
| ------------- | ------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Logs          | Read                | Read and search logs, and follow them live.                                                                                      |
| Metrics       | Read                | Read metrics and their history.                                                                                                  |
| Monitors      | Read, Write, Delete | **Read** reads monitors and their checks. **Write** adds and edits monitors. **Delete** also deletes monitors and their history. |
| Services      | Read                | List the apps of a domain.                                                                                                       |
| Domains       | Read                | Read the overview of your domains and their ingest keys.                                                                         |
| Web analytics | Read, Write         | **Read** reads your analytics. **Write** also saves, edits and removes insights.                                                 |
| Account       | Read                | Read your account.                                                                                                               |

A request that needs a scope the key lacks answers `403` with a message such as `Missing scope logs:read`. Endpoints that no scope covers, such as billing and creating keys, answer `403` to every personal API key.

##  Access

| Access     | The key reaches                                                     |
| ---------- | ------------------------------------------------------------------- |
| Everything | Every domain you are a member of, including domains you join later. |
| Domains    | Only the domains you check.                                         |
| Services   | Only the apps you check, in their domains.                          |

Access never goes beyond your own membership. If you leave a domain, your keys stop reaching it. A request for a domain outside the key answers `403` with "Personal API key is not scoped to this domain or service".

##  Revoke a key

In **API keys**, press the trash button of the key and confirm with **Revoke key**. Anything that uses the key stops working at once. The list also shows when each key was last used and when it expires, so you can find keys nobody uses.

Coding agents that sign in through the browser get a key of their own, labelled `MCP (<client>)`. It expires after 30 days, and you revoke it in the same list.

##  Keep keys safe

- Give each script or agent its own key, so you can revoke one without breaking the others.
- Prefer an expiry over **No expiration**, and **Read** over **Write**.
- Keep keys out of code and out of the browser. A personal API key can read every domain it reaches.