# API keys

> Create a key for the REST API or for a connected assistant, with read or write access.

Everything that talks to workelligence by machine, the REST API and the MCP server, signs in with an API key.

## Create a key

1. Open **Settings → API & Agents**.
2. Under **API keys**, enter a **Key name**, for example "Claude Desktop" or "Zapier".
3. Tick **write access** if the key may create and change records. Without it, the key reads only.
4. Click **Create key**. The key starts with `ago_` and is shown once; copy it now. Only a hash is stored.

## Good practice

- One key per tool or assistant, so the activity log shows who did what.
- Read access unless writing is really needed.
- **Revoke** a key you no longer need or that may have leaked; it stops working at once.

Keys respect the workspace: a module that is off is invisible to the key, and the key can never finalize an invoice.