# API keys

API keys authenticate the CLI. Browser use needs only sign-in.

## Install the CLI, then create a key

[Install the CLI](/docs/get-started#install-the-cli), then run `zerocool auth login`.
Open the browser link and approve it. The CLI creates and saves the new key for you.
You do not need to create or copy a key first.
For manual key management, see [Create an API key](/docs/flows/api-key).

| Role | The key can |
| --- | --- |
| **Viewer** | Read audits, findings and comments, and check prices |
| **Member** | Also start, cancel and fork audits, and add comments |
| **Admin** | Also manage workspace members and funding through the CLI |

A single-workspace key requires direct membership. All workspaces includes future workspace access.
The key never exceeds its creator's current access or its selected role ceiling.

## Authenticate

Run `zerocool auth login`. It prints a link. Open it where you are signed in, choose the key's scope, role and expiry, and select **Approve**.
To save a key that you already have, pipe it to `zerocool auth login --with-key-stdin`.
For CLI automation, supply `ZEROCOOL_API_KEY` from a secret store.
Keep keys out of URLs, source control, browser storage, logs and chat.
Use separate keys for separate tools and prefer the narrowest scope.

## Expiry, rotation and revocation

**Profile → API keys** shows expiry and provides **Revoke**.
To rotate, create a replacement, update its consumers, verify access with `zerocool workspaces`, then revoke the old key.
There is no in-place rotation button. Expired or revoked keys receive HTTP `401`.
If a key is exposed, revoke it and issue a replacement.