> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vein.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an API key

> Issue a key for the Vein API from Settings, choose its scopes, and revoke it when you are done.

If you want portfolio data in your own tools rather than in the product, the
[Vein API](/quickstart) reads the same figures programmatically. Keys are issued
from the **API Keys** panel on your Settings page.

<Warning>
  This panel is investor-side and requires the partner role or above. It does not
  appear on a company's Settings page at all; see
  [roles and permissions](/guides/roles-and-permissions).
</Warning>

## Issue one

<Steps>
  <Step title="Open API Keys in Settings">
    The panel lists every key your firm has issued, each with its scopes and its
    status. A revoked key stays listed rather than disappearing, so the record of
    what once had access survives.
  </Step>

  <Step title="Name it after where it will live">
    The name is only for you, and its whole job is to make a key identifiable
    months later when you are deciding whether it is still needed. "Production
    integration" or "Ben's reporting script" is useful; "API key 2" is not.
  </Step>

  <Step title="Choose test or live">
    Test keys are for building against. Reach for a live key once the thing
    you are building is actually running.
  </Step>

  <Step title="Select scopes">
    Each scope grants read access to one kind of data, and the key can do nothing
    outside the ones you tick:

    | Scope            | Grants                                |
    | ---------------- | ------------------------------------- |
    | `companies:read` | The portfolio companies themselves    |
    | `metrics:read`   | Their financial metrics               |
    | `accounts:read`  | Their financial accounts              |
    | `sources:read`   | Which providers the figures came from |

    Everything the API offers is read-only; there is no scope that writes. Tick
    only what the integration needs. A script that charts runway does not need
    `sources:read`, and narrowing the key now limits what a leaked key exposes
    later.
  </Step>

  <Step title="Copy the key immediately">
    The full key is shown **once**, at the moment it is created. Vein stores a
    hash rather than the key itself, so nobody, including us, can show it to
    you again.

    Copy it into wherever it is going before closing the dialog. If you lose it,
    revoke the key and issue another; there is no recovery path.
  </Step>
</Steps>

<Tip>
  Put the key in your secret manager or environment variables, never in a
  committed file. Anyone holding it can read everything its scopes allow, for as
  long as it is live.
</Tip>

## Revoking

Revoke from the same panel. It takes effect immediately and cannot be undone.
Calls made with that key start failing at once, so revoke the key of a departing
colleague or a retired script rather than leaving it live.

Revoking one key never affects another. Issuing a separate key per integration is
worth the small extra effort, because it means you can retire one without
breaking the others.

## What a key does not grant

A key reads what your firm can already see in the product. It does not widen your
access: a company whose data you cannot read in the Portfolio is not readable
through the API either, and consent still gates the whole thing.

Access to a company's ongoing data is granted by that company, not by a scope.
See [request data access](/guides/request-data-access) for how to ask, and the
[authentication reference](/authentication) for how consent surfaces in API
responses.