# Create an API key

[Install the CLI](/docs/get-started#install-the-cli) first, then use `zerocool auth login` to create and save its API key.
Anyone signed in can approve the login. Manual key creation in the portal is optional.

## Ask your agent

> Help me set up the Zero Cool CLI with an API key.

The agent runs `zerocool auth login` and gives you a link.
Open it where you are signed in, choose the key's **Scope**, **Role** and **Expires**, and select **Approve**.
The CLI then uses the new key. Never paste a key into the chat.

## In the portal

1. Open the account menu and select **Profile**.
2. In **API keys**, select **Create API key**.
3. Enter a **Name** that says where you use the key.
4. Choose the **Scope**: one workspace or **All workspaces**.
5. Choose the **Role**: the **viewer role** to read, the **member role** to start audits, the **admin role** for admin tasks.
6. Choose when it **Expires**: **30 days**, **90 days** or **1 year**.
7. Select **Create key**, then **Copy key**. You cannot view the key again.

To revoke a key, select **Revoke** next to it, then confirm **Revoke**.

## CLI

```sh
zerocool auth login
zerocool auth status
zerocool keys list
```

`zerocool auth login` prints a link. Open it where you are signed in, choose the key's scope, role and expiry, and select **Approve**.
To save a key that you already have, pipe it to `zerocool auth login --with-key-stdin`.
[API keys](/docs/api-keys) covers rotation, revocation and safe storage.