# Monitor and revoke API keys

Review every API key in your organisation, check the revocation history, and revoke a key that should no longer work.

## Before you begin

- You need the Admin or Owner role. Both can review and revoke every key in the organisation. Project managers and Account Managers can revoke only project keys, from the project page. [Roles and permissions](https://docs.atlas.ilionx.dev/reference/roles-and-permissions.md) lists what each role can do.

## Review the keys

1. In the sidebar, open **Manage** > **API keys**.
2. Read the summary strip at the top. It shows:
   - the number of **Active** keys
   - keys created **This month**
   - keys that were **Never used**
   - keys **Expiring soon**, which expire within 30 days
   - keys **Revoked this month**
   - a tile for the busiest key, labelled with its name (or **Top key** when there is none)

   The **Expiring Soon** badge in the **Status** column of the table is stricter. It marks keys that expire within 7 days.

3. In the **API Keys** tab, scan the table. The columns are **Context**, **Key**, **Owner**, **Usage**, **Status** and **Created**.
4. Use the column filters to narrow the list, for example by key name, owner, space or project. **Context** shows the space or project a key is acting under. It flags keys of **Over budget** or **Archived** projects.

## Review the revocation history

1. Switch to the **Revocations** tab.
2. Read each row. It shows the credential, who revoked it and when (**Revoked By**, **Revoked At**), and the number of **Requests**. It also shows the space or project the key was acting under at that moment.

Rows stay after the spaces, projects or users involved are deleted.

## Revoke a key

1. In the **API Keys** table, open the actions menu (⋮) on the row and select **Revoke**.
2. In the **Revoke API Key?** dialog, select **Revoke Key**.

**Result:** ATLAS records the key in the revocation history with you as the revoker, then deletes it. The key stops working within seconds.

## Check the keys of a space

Open the space and choose the **Active Keys** tab. It's available for Team spaces and is read-only. It shows only the end of each key. To revoke, use the organisation's **API keys** page.

## Good to know

- The maximum key lifetime is set once for the whole organisation. See [Cap API key lifetime](https://docs.atlas.ilionx.dev/guides/admin/spaces-manage-policies.md#cap-api-key-lifetime).
- Removing a person from a space or project unbinds their keys but doesn't delete them.
- Suspending an organisation or archiving a project makes the gateway refuse calls made with the affected keys.

## Related

- [API keys reference](https://docs.atlas.ilionx.dev/reference/api-keys.md)
- [API keys](https://docs.atlas.ilionx.dev/concepts/api-keys.md)