# My API Keys and access restrictions

Integration credentials and tokens limit API access by permitted operations and IP address.

*Release 3.3 · admin, developer*

**Settings › Account › My Api Keys**

## What it is

**My Api Keys** manages credentials used by integrations. A credential issues tokens for permitted scopes, and a token can be restricted to an IP address. Credentials and issued tokens are separate records with separate delete actions.

## Who uses it and why

- Administrators ask Powerfront to provision or revoke integration access.
- Developers use the supplied credential or token to call supported integration operations.

## Where to find it

Powerfront manages **Settings › Account › My Api Keys**. The screen contains **Credential Keys** and **Api Tokens**. Ask Powerfront to create, inspect or delete credentials and tokens for you.

## How it works

Powerfront creates a credential with **New Credential**, supplies its scopes and optionally restricts issuance to listed IP addresses. Scope names are comma-separated and normalised to lower case.

An integration requests a token using its secret, a requester name and the requested scope. It may also supply the website account. A request for a scope outside the credential's permitted list is rejected. The token records the requester, scope, website, IP address and expiry.

Alternatively, Powerfront can use **New Token** to create a signed token from a credential. This screen's usual lifetime is 12 hours. **Long Lived Token** changes it to 100 years.

The lists show **Scopes**, **Last Used** and token expiry information. Token use checks the required scope and, when set, an exact IP address match.

## Configure it

Give Powerfront the operations your integration needs and the IP addresses it will use. Ask for the narrowest suitable scope list. The named scope categories in this release include voice and order operations; confirm the scope required by your integration with Powerfront.

**Skip Ip Address Check** removes the token's IP binding. It does not bypass the credential's restrictions on where tokens may be issued.

Tokens requested directly by an integration use an environment-level lifetime, initially seven days. Use the returned expiry and ask Powerfront to confirm any account-specific arrangement.

### Fields

| Field | Where | Required | What it is for |
|---|---|---|---|
| Scopes (comma separated) | Settings › Account › My Api Keys | Yes | Specifies the integration operations that a credential may request. |
| Restricted IP Addresses (comma separated) | Settings › Account › My Api Keys | No | Limits the IP addresses from which the credential can issue tokens; blank allows issuance without this restriction. |
| Secret | Settings › Account › My Api Keys | Yes | Identifies the credential used to create a token. |
| Long Lived Token | Settings › Account › My Api Keys | No | Creates a token with a 100-year lifetime instead of the usual 12-hour lifetime for tokens created on this screen. |
| Skip Ip Address Check | Settings › Account › My Api Keys | No | Removes the issued token's IP restriction; credential restrictions still apply when issuing it. |

### Permissions

| Permission | Lets you |
|---|---|
| Developer | Allows supported API actions to create credentials and tokens and delete them; the My Api Keys screen is Powerfront-managed. |

## Limits and good to know

- A blank credential IP list imposes no issuance IP restriction. IP matching uses listed addresses, without a subnet-range control on this screen.
- Ask Powerfront to delete a credential to stop it issuing new tokens. Powerfront must delete existing tokens separately to revoke their access.
- Token refresh requires the issuing IP address to match and is accepted only while the token remains available and less than one hour has passed since its expiry.
- Refresh is not a substitute for explicit revocation. Ask Powerfront to delete a token that must stop working.
- The list can show a dash for a long-lived token's expiry. That display does not mean the token has no expiry.

## Depends on and works with

### This feature uses

- **Configured in** [Roles and permissions](ADM-008.md): The Developer role controls the available credential-management API actions.
- **Related** [INSIDE API](EXT-018.md): Use scoped integration tokens only with INSIDE API operations that support them.

### Used by

- **Required by** [ACP compatibility for AI agents](AIP-020.md): Token-authenticated requests require credentials with permission to run AI features.
- **Configures** [Company Shows with prerecorded videos](RTC-029.md): Scoped integration credentials control access to show listings.
- **Configures** [INSIDE API](EXT-018.md): Integration credentials define permitted scopes and IP restrictions for supported token-authenticated operations.
- **Related** [Roles and permissions](ADM-008.md): Scoped integration credentials have separate access rules from operator roles.

## FAQ and troubleshooting

### Why can I not find My Api Keys?

Powerfront manages this screen. Ask Powerfront to make the credential change for you.

### Why is a token request rejected?

Check that the credential exists, the issuing IP address is permitted and every requested scope is allowed.

### Why does a token fail after our integration moves networks?

An IP-bound token must be used from its recorded IP address. Ask Powerfront to review the token and credential restrictions.

### Does deleting the credential revoke its tokens?

No. Ask Powerfront to delete the existing tokens as well.