Where can I find the list of available scopes?

The full scope list is in the [API key scopes documentation](/docs/advanced/platform/api-keys#scopes). The server SDKs also ship a `Scopes` enum so you can reference them by constant (e.g., `Scopes.DatabasesRead`) instead of typing strings.

Announcing the Keys API: Create and manage API keys with Server SDKs_

Q: What is the Appwrite Keys API?

It is a set of endpoints on the `Project` service that lets you create, list, update, and delete API keys programmatically from any Appwrite server SDK. Previously, API keys could only be managed through the Appwrite Console, which made automation and multi-tenant key provisioning awkward.

Q: What scopes do I need to manage API keys?

Two new scopes: `keys.read` for listing and retrieving keys, and `keys.write` for creating, updating, and deleting keys. These are sensitive: a key with `keys.write` can mint another key with any scope, effectively giving full access to the project. Only assign them in trusted environments and never use them client-side.

Q: Can I set an expiration date on a key?

Yes. Pass an ISO 8601 timestamp in the `expire` field when calling `project.createKey`. Once that time passes, the key stops working automatically. Setting expirations on every key is a good default for short-lived credentials in CI and customer-facing tenants.

Q: How is the Keys API different from session-based auth?

Sessions identify end users of your app via [Appwrite Auth](/docs/products/auth), while API keys identify trusted backend services that act on behalf of the project. The Keys API itself uses an existing API key with `keys.write` scope to create new keys, so it is strictly a server-to-server flow.

API keys can now be created, updated, and deleted programmatically using Appwrite Server SDKs. Automate key provisioning for CI/CD, multi-tenant setups, and team onboarding workflows.

Matej Bačo

Engineering Lead

Apr 16, 20264 min read

Managing API keys has always required navigating to the Appwrite Console, selecting scopes, and manually creating each key. For a single project, that works. For teams managing multiple environments, onboarding new services, or provisioning keys as part of automated pipelines, it becomes a bottleneck.

Today, we are announcing the Keys API, allowing you to create, update, and delete API keys programmatically through the Appwrite server SDKs.

This is part of a wider effort to make everything in Appwrite accessible through the API. Our goal is to ensure that any action you can perform in the Appwrite Console can also be done programmatically, giving you full control over your projects through code.

Why this matters

API keys are the foundation of server-side authentication in Appwrite. Every server SDK call, every CLI operation, and every backend integration depends on them. Being able to manage keys from code opens up workflows that were previously manual:

CI/CD pipelines that provision scoped keys for each deployment environment
Multi-tenant platforms that create isolated keys per customer with only the scopes they need
Team onboarding where new services get their own keys automatically
Key rotation workflows that create a new key, update credentials, and retire the old one without downtime

How it works

The Keys API introduces two new API key scopes:

keys.read for listing and retrieving API keys
keys.write for creating, updating, and deleting API keys

The methods live on the Project service, alongside existing project-level operations like environment variables.

Create an API key

Node.js

import { Client, Project, ID, Scopes } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.createKey({
    keyId: ID.unique(),
    name: 'My API Key',
    scopes: [Scopes.DatabasesRead, Scopes.DatabasesWrite],
    expire: '2026-12-31T23:59:59.000+00:00'
});

import { Client, Project, ID, Scopes } from "npm:node-appwrite";

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.createKey({
    keyId: ID.unique(),
    name: 'My API Key',
    scopes: [Scopes.DatabasesRead, Scopes.DatabasesWrite],
    expire: '2026-12-31T23:59:59.000+00:00'
});

<?php

use Appwrite\Client;
use Appwrite\ID;
use Appwrite\Services\Project;

$client = new Client();

$client
    ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    ->setProject('<PROJECT_ID>')
    ->setKey('<YOUR_API_KEY>');

$project = new Project($client);

$result = $project->createKey(
    keyId: ID::unique(),
    name: 'My API Key',
    scopes: ['databases.read', 'databases.write'],
    expire: '2026-12-31T23:59:59.000+00:00'
);

from appwrite.client import Client
from appwrite.id import ID
from appwrite.services.project import Project
from appwrite.enums.scopes import Scopes

client = Client()
client.set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
client.set_project('<PROJECT_ID>')
client.set_key('<YOUR_API_KEY>')

project = Project(client)

result = project.create_key(
    key_id=ID.unique(),
    name='My API Key',
    scopes=[Scopes.DATABASES_READ, Scopes.DATABASES_WRITE],
    expire='2026-12-31T23:59:59.000+00:00'
)

require 'appwrite'

include Appwrite

client = Client.new
    .set_endpoint('https://<REGION>.cloud.appwrite.io/v1')
    .set_project('<PROJECT_ID>')
    .set_key('<YOUR_API_KEY>')

project = Project.new(client)

response = project.create_key(
    key_id: ID.unique(),
    name: 'My API Key',
    scopes: ['databases.read', 'databases.write'],
    expire: '2026-12-31T23:59:59.000+00:00'
)

using Appwrite;
using Appwrite.Enums;
using Appwrite.Services;
using Appwrite.Models;

Client client = new Client()
    .SetEndPoint("https://<REGION>.cloud.appwrite.io/v1")
    .SetProject("<PROJECT_ID>")
    .SetKey("<YOUR_API_KEY>");

Project project = new Project(client);

var result = await project.CreateKey(
    keyId: ID.Unique(),
    name: "My API Key",
    scopes: new List<Scopes> {Scopes.DatabasesRead, Scopes.DatabasesWrite},
    expire: "2026-12-31T23:59:59.000+00:00"
);

import 'package:dart_appwrite/dart_appwrite.dart';
import 'package:dart_appwrite/enums.dart' as enums;

Client client = Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

Project project = Project(client);

final result = await project.createKey(
    keyId: ID.unique(),
    name: 'My API Key',
    scopes: [enums.Scopes.databasesRead, enums.Scopes.databasesWrite],
    expire: '2026-12-31T23:59:59.000+00:00',
);

import io.appwrite.Client
import io.appwrite.ID
import io.appwrite.enums.Scopes
import io.appwrite.services.Project

val client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

val project = Project(client)

val result = project.createKey(
    keyId = ID.unique(),
    name = "My API Key",
    scopes = listOf(Scopes.DATABASES_READ, Scopes.DATABASES_WRITE),
    expire = "2026-12-31T23:59:59.000+00:00"
)

import io.appwrite.Client;
import io.appwrite.ID;
import io.appwrite.enums.Scopes;
import io.appwrite.coroutines.CoroutineCallback;
import io.appwrite.services.Project;

Client client = new Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>");

Project project = new Project(client);

project.createKey(
    ID.unique(),                                     // keyId
    "My API Key",                                    // name
    List.of(Scopes.DATABASES_READ, Scopes.DATABASES_WRITE), // scopes
    "2026-12-31T23:59:59.000+00:00",                // expire
    new CoroutineCallback<>((result, error) -> {
        if (error != null) {
            error.printStackTrace();
            return;
        }
        System.out.println(result);
    })
);

import Appwrite
import AppwriteEnums

let client = Client()
    .setEndpoint("https://<REGION>.cloud.appwrite.io/v1")
    .setProject("<PROJECT_ID>")
    .setKey("<YOUR_API_KEY>")

let project = Project(client)

let result = try await project.createKey(
    keyId: ID.unique(),
    name: "My API Key",
    scopes: [Scopes.databasesRead, Scopes.databasesWrite],
    expire: "2026-12-31T23:59:59.000+00:00"
)

package main

import (
    "fmt"
    "github.com/appwrite/sdk-for-go/appwrite"
    "github.com/appwrite/sdk-for-go/id"
)

func main() {
    client := appwrite.NewClient(
        appwrite.WithEndpoint("https://<REGION>.cloud.appwrite.io/v1"),
        appwrite.WithProject("<PROJECT_ID>"),
        appwrite.WithKey("<YOUR_API_KEY>"),
    )

    project := appwrite.NewProject(client)
    result, err := project.CreateKey(
        id.Unique(),
        "My API Key",
        []string{"databases.read", "databases.write"},
        project.WithCreateKeyExpire("2026-12-31T23:59:59.000+00:00"),
    )

    if err != nil {
        panic(err)
    }

    fmt.Println(result)
}

use appwrite::Client;
use appwrite::id::ID;
use appwrite::enums::Scopes;
use appwrite::services::project::Project;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new()
        .set_endpoint("https://<REGION>.cloud.appwrite.io/v1")
        .set_project("<PROJECT_ID>")
        .set_key("<YOUR_API_KEY>");

    let project = Project::new(&client);

    let result = project.create_key(
        ID::unique(),                                  // key_id
        "My API Key",                                  // name
        vec![Scopes::DatabasesRead, Scopes::DatabasesWrite], // scopes
        Some("2026-12-31T23:59:59.000+00:00"),         // expire
    ).await?;

    println!("{:?}", result);
    Ok(())
}

Each key is created with a specific set of scopes and an optional expiration date. When no expiration is set, the key remains valid indefinitely.

Update an API key

Node.js

const result = await project.updateKey({
    keyId: '<KEY_ID>',
    name: 'Updated Key',
    scopes: [Scopes.DatabasesRead, Scopes.DatabasesWrite, Scopes.UsersRead],
    expire: '2027-06-30T23:59:59.000+00:00'
});

const result = await project.updateKey({
    keyId: '<KEY_ID>',
    name: 'Updated Key',
    scopes: [Scopes.DatabasesRead, Scopes.DatabasesWrite, Scopes.UsersRead],
    expire: '2027-06-30T23:59:59.000+00:00'
});

$result = $project->updateKey(
    keyId: '<KEY_ID>',
    name: 'Updated Key',
    scopes: ['databases.read', 'databases.write', 'users.read'],
    expire: '2027-06-30T23:59:59.000+00:00'
);

result = project.update_key(
    key_id='<KEY_ID>',
    name='Updated Key',
    scopes=[Scopes.DATABASES_READ, Scopes.DATABASES_WRITE, Scopes.USERS_READ],
    expire='2027-06-30T23:59:59.000+00:00'
)

response = project.update_key(
    key_id: '<KEY_ID>',
    name: 'Updated Key',
    scopes: ['databases.read', 'databases.write', 'users.read'],
    expire: '2027-06-30T23:59:59.000+00:00'
)

var result = await project.UpdateKey(
    keyId: "<KEY_ID>",
    name: "Updated Key",
    scopes: new List<Scopes> {Scopes.DatabasesRead, Scopes.DatabasesWrite, Scopes.UsersRead},
    expire: "2027-06-30T23:59:59.000+00:00"
);

final result = await project.updateKey(
    keyId: '<KEY_ID>',
    name: 'Updated Key',
    scopes: [enums.Scopes.databasesRead, enums.Scopes.databasesWrite, enums.Scopes.usersRead],
    expire: '2027-06-30T23:59:59.000+00:00',
);

val result = project.updateKey(
    keyId = "<KEY_ID>",
    name = "Updated Key",
    scopes = listOf(Scopes.DATABASES_READ, Scopes.DATABASES_WRITE, Scopes.USERS_READ),
    expire = "2027-06-30T23:59:59.000+00:00"
)

project.updateKey(
    "<KEY_ID>",                                      // keyId
    "Updated Key",                                   // name
    List.of(Scopes.DATABASES_READ, Scopes.DATABASES_WRITE, Scopes.USERS_READ), // scopes
    "2027-06-30T23:59:59.000+00:00",                // expire
    new CoroutineCallback<>((result, error) -> {
        if (error != null) {
            error.printStackTrace();
            return;
        }
        System.out.println(result);
    })
);

let result = try await project.updateKey(
    keyId: "<KEY_ID>",
    name: "Updated Key",
    scopes: [Scopes.databasesRead, Scopes.databasesWrite, Scopes.usersRead],
    expire: "2027-06-30T23:59:59.000+00:00"
)

result, err := project.UpdateKey(
    "<KEY_ID>",
    "Updated Key",
    []string{"databases.read", "databases.write", "users.read"},
    project.WithUpdateKeyExpire("2027-06-30T23:59:59.000+00:00"),
)

let result = project.update_key(
    "<KEY_ID>",                                    // key_id
    "Updated Key",                                 // name
    vec![Scopes::DatabasesRead, Scopes::DatabasesWrite, Scopes::UsersRead], // scopes
    Some("2027-06-30T23:59:59.000+00:00"),         // expire
).await?;

Use this to adjust scopes as requirements change, or to extend or shorten a key's expiration window.

Delete an API key

Node.js

await project.deleteKey({
    keyId: '<KEY_ID>'
});

await project.deleteKey({
    keyId: '<KEY_ID>'
});

$project->deleteKey(
    keyId: '<KEY_ID>'
);

project.delete_key(
    key_id='<KEY_ID>'
)

project.delete_key(
    key_id: '<KEY_ID>'
)

await project.DeleteKey(
    keyId: "<KEY_ID>"
);

await project.deleteKey(
    keyId: '<KEY_ID>',
);

project.deleteKey(
    keyId = "<KEY_ID>"
)

project.deleteKey(
    "<KEY_ID>",                                      // keyId
    new CoroutineCallback<>((result, error) -> {
        if (error != null) {
            error.printStackTrace();
            return;
        }
        System.out.println(result);
    })
);

try await project.deleteKey(
    keyId: "<KEY_ID>"
)

_, err := project.DeleteKey(
    "<KEY_ID>",
)

project.delete_key(
    "<KEY_ID>",
).await?;

Once deleted, the key immediately stops authenticating API calls.

Bootstrap requirement

To use the Keys API, you need an existing API key with the keys.read and keys.write scopes. This initial key must be created through the Appwrite Console. Once you have it, all subsequent key management can be done programmatically.

Full SDK support

The Keys API is available across all Appwrite Server SDKs. Complete code examples for every supported language are available in the API keys documentation.

Get started

The Keys API is available on Appwrite Cloud today.

Navigate to Overview > Integration > API keys and create an API key with the keys.read and keys.write scopes.
Initialize a Server SDK with your API key.
Use the Project service to manage keys from code.

Full documentation is available on the API keys documentation page.

Resources

API keys documentation

API key scopes reference

How to leverage dynamic API keys for better security

It is a set of endpoints on the Project service that lets you create, list, update, and delete API keys programmatically from any Appwrite server SDK. Previously, API keys could only be managed through the Appwrite Console, which made automation and multi-tenant key provisioning awkward.

Two new scopes: keys.read for listing and retrieving keys, and keys.write for creating, updating, and deleting keys. These are sensitive: a key with keys.write can mint another key with any scope, effectively giving full access to the project. Only assign them in trusted environments and never use them client-side.

Common patterns include CI/CD pipelines provisioning keys per deployment environment, multi-tenant platforms creating isolated keys per customer, automated team onboarding, and zero-downtime key rotation (create the new key, swap credentials, delete the old one). All of this is now scriptable.

Yes. Pass an ISO 8601 timestamp in the expire field when calling project.createKey. Once that time passes, the key stops working automatically. Setting expirations on every key is a good default for short-lived credentials in CI and customer-facing tenants.

The full scope list is in the API key scopes documentation. The server SDKs also ship a Scopes enum so you can reference them by constant (e.g., Scopes.DatabasesRead) instead of typing strings.

Sessions identify end users of your app via Appwrite Auth, while API keys identify trusted backend services that act on behalf of the project. The Keys API itself uses an existing API key with keys.write scope to create new keys, so it is strictly a server-to-server flow.

Announcing the Keys API: Create and manage API keys with Server SDKs_

Why this matters

How it works

Create an API key

Update an API key

Delete an API key

Bootstrap requirement

Full SDK support

Get started

Resources

Frequently asked questions

Read next

Announcing 6-digit codes for email verification and password recovery

Old deployments will no longer fill up your Appwrite Cloud storage

eMudhra certificate compromise: Appwrite is patched

PHP2Shell RCE flaws: Why Appwrite is not affected

Announcing the Appwrite Databases Hackathon

Announcing MCP Events: your agent hears about changes in your Appwrite project

Ready to build?_

Frequently asked questions

What is the Appwrite Keys API?

What scopes do I need to manage API keys?

What workflows does the Keys API unlock?

Can I set an expiration date on a key?

Where can I find the list of available scopes?

How is the Keys API different from session-based auth?

Read next

Announcing 6-digit codes for email verification and password recovery

Old deployments will no longer fill up your Appwrite Cloud storage

eMudhra certificate compromise: Appwrite is patched

PHP2Shell RCE flaws: Why Appwrite is not affected

Announcing the Appwrite Databases Hackathon

Announcing MCP Events: your agent hears about changes in your Appwrite project

Ready to build?_