> ## Documentation Index
> Fetch the complete documentation index at: https://docs.technified.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Generate and manage keys that connect Technified to your Roblox games.

API keys let external applications talk to Technified. Your Roblox games use them to check ban status and sync moderation, and custom tools can use them to read server data.

Open **Settings > API Keys** in the sidebar.

## What a key shows

| Field      | Description                                     |
| ---------- | ----------------------------------------------- |
| Key Prefix | The first characters, for identification        |
| Name       | An optional descriptive name                    |
| Scopes     | The endpoints the key may call (badges)         |
| Created    | When the key was made                           |
| Last Used  | Most recent API call                            |
| Requests   | Approximate total calls made with the key       |
| Expiry     | Optional date after which the key stops working |
| Status     | Active, Revoked or Expired                      |

<Warning>
  The full key is shown only once, at creation. Copy it immediately and store it somewhere safe.
</Warning>

## Create a key

<Steps>
  <Step title="Create">
    Click **Create API Key**.
  </Step>

  <Step title="Name it">
    Add an optional name, for example "Main Game" or "Test Server".
  </Step>

  <Step title="Choose scopes">
    Tick the scopes the key needs. A key with no scopes authenticates but cannot call any endpoint, so grant at least one.
  </Step>

  <Step title="Set controls (optional)">
    Optionally add an expiry date, a per-key rate limit, or an IP allowlist.
  </Step>

  <Step title="Copy it now">
    Copy the key right away. It will not be shown again.
  </Step>
</Steps>

<Note>
  You can have up to **10 API keys** per server. Revoke an unused key to free a slot. See [Limits](/limits) for all creation limits.
</Note>

## Scopes and controls

Each key is **scoped**: it can only call the endpoints whose scopes you granted. Grant the least a key needs.

| Scope              | Grants                                                       |
| ------------------ | ------------------------------------------------------------ |
| `moderation:read`  | Ban/mute status, active punishment lists, moderation logs    |
| `moderation:write` | Create and lift Roblox bans and mutes                        |
| `lookup:read`      | Discord/Roblox lookups, reverse lookup, status               |
| `members:read`     | Member lists, verified users, verification links             |
| `verify:write`     | Create verification tokens and link/unlink accounts          |
| `sync:write`       | Role sync, group sync, nickname updates                      |
| `activity:write`   | Staff/Roblox activity, sessions and heartbeats (game plugin) |
| `server:write`     | Server Manager heartbeat, poll and ack (game plugin)         |

A `:write` scope implies the matching `:read` scope for the same resource. You can change a key's scopes and controls later with **Edit**, without regenerating it.

Beyond scopes, each key can carry optional guards:

* **Expiry**: a date after which the key is rejected.
* **Rate limit**: a per-key requests-per-minute cap, on top of the global rate limits.
* **IP allowlist**: restrict the key to specific IPs or IPv4 CIDR ranges.

<Note>
  Keys created before scoping keep **full access**. Editing such a key applies the scopes you pick. Keys installed by the Roblox integration quick-install request every scope automatically, so the plugin keeps working.
</Note>

## Use a key

<Tabs>
  <Tab title="In a Roblox game">
    Store the key in a server side script only, never in client scripts:

    ```lua theme={null}
    -- ServerScriptService only
    local API_KEY = "your-api-key-here"
    ```

    The Technified module and the Roblox integration read this key automatically.
  </Tab>

  <Tab title="In an external service">
    Send it as a bearer token:

    ```
    Authorization: Bearer your-api-key-here
    ```
  </Tab>
</Tabs>

## Manage keys

| Action | Effect                                                                         |
| ------ | ------------------------------------------------------------------------------ |
| Edit   | Change scopes, expiry, rate limit or IP allowlist without regenerating the key |
| Revoke | Deactivates the key immediately, but keeps it in the list                      |
| Delete | Permanently removes a revoked key                                              |
| Copy   | Copies the key prefix to your clipboard                                        |

## Security

* Never share keys publicly or commit them to version control.
* Name keys by purpose so you know which is which.
* Rotate keys periodically: create a new one, update your apps, then revoke the old one.
* Watch the **Last Used** date and revoke anything that looks wrong.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid API Key">
    Check the key is copied in full and has not been revoked. Make sure it is for the correct server.
  </Accordion>

  <Accordion title="Missing required scope">
    The key does not have the scope that endpoint needs (a `403` with `insufficient_scope`). Open the key, click **Edit**, and add the scope shown in the error.
  </Accordion>

  <Accordion title="API key has expired">
    The key passed its expiry date. Create a new key (or edit the old one's expiry) and update your app.
  </Accordion>

  <Accordion title="Rate limited">
    You are sending too many requests. Wait, then try again, and consider caching responses. A per-key rate limit may also be set on the key itself.
  </Accordion>
</AccordionGroup>