> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Learn how API keys work, how to manage them, and how to use scopes and IP restrictions.

API keys are the primary method of authentication for our APIs. Each API key belongs to an organization and has permission scopes. You can also protect an API key with IP restrictions.

<Card title="Create and Manage API Keys" icon="lock" href="https://dashboard.prem.io/api-keys" arrow="true">
  You can generate and manage API keys in your Prem API Dashboard > Developers > API Keys section.
</Card>

## API keys and organizations

We issue API keys **at the organization level**, not to individual users. This means:

* The API attributes each action of an API key to the **owning organization**.
* Many team members can work together with separate keys in the same organization.
* API keys stay valid independently of individual user accounts.

## Unlimited Keys per Organization

Each organization can create **any number of API keys**. This gives flexibility across environments, services, or teams.

Common usage patterns include:

* One key per environment (e.g., `development`, `staging`, `production`)
* One key per integration (e.g., billing automation, analytics)
* Temporary keys for CI/CD or testing purposes

## IP Restrictions

For better security, you can **restrict an API key to specific IP addresses or subnets**:

* The restrictions **support IPv4**, **IPv6**, and **CIDR notation**
* The API rejects requests from unauthorized IPs with a `403 Forbidden` error

Example entries:

* `192.168.1.10`
* `2001:0db8::/32`
* `203.0.0.0/8`

<Tip>Use IP allowlists to protect critical integrations (e.g., production).</Tip>

## Scoped Permissions

You can limit each API key to a specific set of **scopes**. The scopes define the parts of the API that the key can access.

The dashboard asks you to set these scopes when you create an API key. If you do not specify scopes, the API key has full permissions.

## API Scopes Reference

| Scope                    | Description                                               |
| ------------------------ | --------------------------------------------------------- |
| `api_keys.read`          | View and list API keys associated with your organization. |
| `chats.completion`       | Access chat completion functionality.                     |
| `tools.execute`          | Execute tools and integrations.                           |
| `files.encrypted.read`   | Read encrypted files.                                     |
| `files.encrypted.create` | Upload encrypted files.                                   |
| `files.encrypted.delete` | Delete encrypted files.                                   |
| `audio.transcription`    | Transcribe audio files to text.                           |
| `audio.translation`      | Translate audio from any language to English.             |

This lets you apply the **principle of least privilege** and isolate permissions for each use case.

<Info>A request from a key without the required scope returns `403 Forbidden`.</Info>

## Best Practices

* **Rotate keys regularly** to decrease exposure
* **Use least privilege**: assign only the required scopes
* **Restrict by IP** where possible
* **Do not share keys between environments** or teams

For key management, go to your **Dashboard > API > API Keys**.

If you need help, contact [support](mailto:support@premai.io) or refer to the [Authentication Guide](/authentication).