# API keys

Limit each key to what it needs.

```sh
harebox api-key new --name ci-runner --preset ci
harebox api-key list
```

| Preset | Use |
|---|---|
| `read_only` | Inspect |
| `tenant` | One sandbox; can't create more or read billing |
| `full_sandbox` | Operate a sandbox |
| `ci` | Create and manage its own sandboxes |
| `admin` | Everything |

Keys can also carry a sandbox list, IP allowlist and expiry. Keys last 90 days by default. A key can never grant a scope its creator lacks.

**Rotation has an overlap,** so nothing breaks while you deploy the new secret:

```sh
KEY=$(harebox api-key new --name rotate-me --preset read_only | jq -r .id)
harebox api-key rotate "$KEY" --overlap-seconds 3600
harebox api-key revoke "$KEY"
```