crispy keys

Manage scoped API keys without leaving the terminal.

Create

crispy keys create --scope workspace --permissions campaigns:read,inbox:read --name 'reporting bot' --expires-in 90

• --scope is team, workspace, or resource (default: team)
• --permissions is a comma-separated list like campaigns:read,inbox:read; omit it for full access
• --name gives the key a human-readable label
• --expires-in <days> sets automatic expiry

The full key is printed once and never shown again, so save it immediately. Everything you see afterwards is only the key prefix.

List

crispy keys list shows every key with its prefix, name, scope, permissions, last-used time, and creation date. Add --format json for scripts.

Revoke

crispy keys revoke <key-id> deletes exactly one key by UUID or its complete displayed prefix, including the trailing ... (for example, ws_abcdef123...). Partial prefixes are rejected. Revoking a key immediately signs out any terminal or integration that used it.

Scoped keys are the right way to give each automation exactly the access it needs: a reporting script gets a read-only key, a campaign runner gets campaign permissions, and your main key keeps full access. If one leaks, you revoke that one key and nothing else is exposed.