# Create and manage API keys

> Authenticate your own scripts and servers against your help.ai workspace.

API keys let your own scripts and servers call help.ai, for example to read form submissions into your CRM. Each key belongs to one workspace and to the person who created it.

## API keys or deployment keys?

| Key | Where to find it | Use it for |
| --- | --- | --- |
| API key | **Connections** → **API Keys** | Your own scripts and servers calling help.ai |
| Deployment public key | The deployment's **Install** tab | The chat widget and hosted page; safe in a browser |
| Deployment secret key | The deployment's **Install** tab | Signing tokens for signed-in users, and server-to-server calls to that deployment; keep it on your server |

## Create a key

1. Open **API Keys** and select **Create API Key**.
2. Enter a **Name** of up to 100 characters, such as "CRM sync".
3. Choose a **Permission**: **Read**, **Write** or **Admin**. It starts at **Read**. **What a key can do**, below, explains each.
4. Add an optional **Note** for your team, up to 500 characters.
5. Pick an **Expiration** date and time if the key should stop working on its own, or leave it empty for no expiration. Once set, an expiration can be moved but not removed.
6. Keep **Enabled** on and select **Create API Key**.

A message confirms the new key and shows it in full. The key then appears in your **API Keys** list: **Show API key** reveals it and **Copy API key** copies it.

Anyone in the workspace, Viewers included, can create keys. Each person sees and manages only the keys they created.

## Use the key

Send the key in the `x-api-key` header of each request:

```http
x-api-key: YOUR_API_KEY
```

A key acts as you. It works only while the key, your account, the workspace and your membership are active, and until it expires. It never gives access to your other workspaces.

## What a key can do

A key's **Permission** limits your role in the workspace, and it never does more than you can:

| Permission | Acts like | For example |
| --- | --- | --- |
| **Read** | A Viewer | Reads agents, conversations, forms and settings, and can't change them |
| **Write** | At most a Member | Creates, changes and deletes agents, deployments, content and forms; can't manage members, settings or billing |
| **Admin** | Your own role | Everything you can do |

With a key, only an **Admin** key can view or manage API keys, change your account details, accept or decline invitations, or create a workspace, so a **Read** or **Write** key can't reveal or make a stronger key. No key can change your email: sign in for that. Give each script the lowest permission it needs.

## Manage keys

From the row menu (⋯):

- **Edit** changes the name, permission, note, expiration or **Enabled**.
- **Disable** turns a key off right away, and **Enable** turns it back on.
- **Delete** removes the key for good. This can't be undone.

help.ai emails you when one of your keys is created, turned off or deleted.

<Tip>
Give each script its own key with an **Expiration**. If a key leaks, delete it right away and create a new one.
</Tip>