# API keys

Create keys for your own app, choose their scopes and revoke them.

API keys let your own app call Lornos. Each key belongs to one workspace, and every request it makes reads and writes that workspace only.

## Create a key

Owners and admins open **API keys** and choose:

- **Name**, so you can tell keys apart later, for example "Production website".
- **Expires**: in 30 days, 90 days, a year, or never.
- **Scopes**: what the key may do.

| Scope | Allows |
|---|---|
| `chat` | Asking questions with `POST /api/chat`, and the `ask` and `search` tools of the [MCP server](https://lornos.dev/docs/mcp.md). |
| `sources` | Uploading, listing, re-indexing and deleting sources under `/api/v1/sources`, and the `list_sources` and `get_source` MCP tools. |

A key can hold both. The full key is shown once, so copy it then; Lornos keeps only a hash.

## Use a key

Send it as a Bearer token on every request:

```text
Authorization: Bearer lrn_…
```

A missing, revoked or expired key gets `401`. The [API reference](https://lornos.dev/docs/api.md#authentication) lists every response.

## Revoke a key

Use **Revoke**, then **Confirm revoke**, in the key's row. It stops working at once. The list shows each key's status (Active, Revoked or Expired), when it was last used and when it expires.