API keys_

Secure your application with Appwrite API Keys. Discover how to create and manage API keys to control access and enhance your application's security.

6 min read

Raw

API keys are secrets used by Appwrite Server SDKs and the Appwrite CLI to prove their identity. What can be accessed each API key is restricted by scopes instead of permissions.

Best practice

It is a best practice to grant only the scopes you need to meet your project's goals to an API key. API keys should be treated as a secret. Never share the API key and keep API keys out of client applications.

Create API key

To create a new API key, open API Keys in the project sidebar and click Create API key.

You can then use the API key to initialize the Appwrite client in your server-side apps.

const sdk = require('node-appwrite');

const client = new sdk.Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<YOUR_PROJECT_ID>')
    .setKey('<YOUR_API_KEY>'); // Your API key

When adding a new API Key, you can choose which scopes to grant your application. If you need to replace your API Key, create a new key, update your app credentials and, once ready, delete your old key.

Manage API keys with a Server SDK

You can also manage API keys programmatically using a Server SDK. This requires an API key with the keys.read and keys.write scopes.

Creating keys

Creating API keys with the Project API is deprecated as of 17 August 2026. Create long-lived keys in the Appwrite Console. The Project API can list, update, and delete existing keys, and can issue ephemeral keys for short-lived access. Learn more in the changelog.

Sensitive scopes

The keys.read and keys.write scopes are sensitive. An API key with keys.write can change the scopes of existing keys and delete them. Only assign these scopes to keys used in trusted, secure environments, and never expose them in client-side applications.

List API keys

import { Client, Project } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.listKeys();

Get an API key

import { Client, Project } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.getKey({
    keyId: '<KEY_ID>'
});

Create an ephemeral key

Ephemeral keys are short-lived API keys that expire after a set duration, useful for temporary or single-session server access without managing a long-lived key. Pass the scopes to grant and a duration in seconds (maximum 3600). The response includes the generated secret and its expiration time.

import { Client, Project, ProjectKeyScopes } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.createEphemeralKey({
    scopes: [ProjectKeyScopes.TablesRead, ProjectKeyScopes.TablesWrite],
    duration: 600
});

Update an API key

import { Client, Project, ProjectKeyScopes } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

const result = await project.updateKey({
    keyId: '<KEY_ID>',
    name: 'Updated Key',
    scopes: [ProjectKeyScopes.DatabasesRead, ProjectKeyScopes.DatabasesWrite, ProjectKeyScopes.UsersRead],
    expire: '2027-06-30T23:59:59.000+00:00'
});

Delete an API key

import { Client, Project } from 'node-appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>')
    .setKey('<YOUR_API_KEY>');

const project = new Project(client);

await project.deleteKey({
    keyId: '<KEY_ID>'
});

Scopes

When adding a new API key, you choose which scopes to grant. Scopes are grouped by service, matching the categories shown in the Appwrite Console.

Name	Description
`sessions.write`	Access to create, update, and delete user sessions
`users.read`	Access to read your project's users
`users.write`	Access to create, update, and delete your project's users
`teams.read`	Access to read your project's teams
`teams.write`	Access to create, update, and delete your project's teams

Name	Description
`databases.read`	Access to read your project's databases
`databases.write`	Access to create, update, and delete your project's databases
`tables.read`	Access to read your project's database tables
`tables.write`	Access to create, update, and delete your project's database tables
`columns.read`	Access to read your project's database table columns
`columns.write`	Access to create, update, and delete your project's database table columns
`indexes.read`	Access to read your project's database table indexes
`indexes.write`	Access to create, update, and delete your project's database table indexes
`rows.read`	Access to read your project's database rows
`rows.write`	Access to create, update, and delete your project's database rows
`embeddings.write`	Access to generate vector embeddings
`documentsdb.read`	Access to read your project's document databases
`documentsdb.write`	Access to create, update, and delete your project's document databases
`documentsdb.collections.read`	Access to read your project's document database collections
`documentsdb.collections.write`	Access to create, update, and delete your project's document database collections
`documentsdb.documents.read`	Access to read your project's document database documents
`documentsdb.documents.write`	Access to create, update, and delete your project's document database documents
`documentsdb.indexes.read`	Access to read your project's document database collection indexes
`documentsdb.indexes.write`	Access to create, update, and delete your project's document database collection indexes
`vectorsdb.read`	Access to read your project's vector databases
`vectorsdb.write`	Access to create, update, and delete your project's vector databases
`vectorsdb.collections.read`	Access to read your project's vector database collections
`vectorsdb.collections.write`	Access to create, update, and delete your project's vector database collections
`vectorsdb.documents.read`	Access to read your project's vector database documents
`vectorsdb.documents.write`	Access to create, update, and delete your project's vector database documents
`vectorsdb.indexes.read`	Access to read your project's vector database collection indexes
`vectorsdb.indexes.write`	Access to create, update, and delete your project's vector database collection indexes

Name	Description
`functions.read`	Access to read your project's functions and code deployments
`functions.write`	Access to create, update, and delete your project's functions and code deployments
`execution.read`	Access to read your project's execution logs
`execution.write`	Access to execute your project's functions

Name	Description
`files.read`	Access to read your project's storage files and preview images
`files.write`	Access to create, update, and delete your project's storage files
`buckets.read`	Access to read your project's storage buckets
`buckets.write`	Access to create, update, and delete your project's storage buckets

Name	Description
`providers.read`	Access to read your project's providers
`providers.write`	Access to create, update, and delete your project's providers
`messages.read`	Access to read your project's messages
`messages.write`	Access to create, update, and delete your project's messages
`topics.read`	Access to read your project's topics
`topics.write`	Access to create, update, and delete your project's topics
`subscribers.read`	Access to read your project's subscribers
`subscribers.write`	Access to create, update, and delete your project's subscribers
`targets.read`	Access to read your project's targets
`targets.write`	Access to create, update, and delete your project's targets

Name	Description
`sites.read`	Access to read your project's sites and deployments
`sites.write`	Access to create, update, and delete your project's sites and deployments
`log.read`	Access to read your site's logs
`log.write`	Access to update and delete your site's logs

Name	Description
`locale.read`	Access to your project's Locale service
`avatars.read`	Access to your project's Avatars service
`health.read`	Access to read your project's health status
`migrations.read`	Access to read your project's migrations
`migrations.write`	Access to create, update, and delete your project's migrations
`tokens.read`	Access to read your project's tokens
`tokens.write`	Access to create, update, and delete your project's tokens
`webhooks.read`	Access to read your project's webhooks
`webhooks.write`	Access to create, update, and delete your project's webhooks
`keys.read`	Access to read your project's API keys
`keys.write`	Access to update and delete your project's API keys
`rules.read`	Access to read your project's proxy rules
`rules.write`	Access to create, update, and delete your project's proxy rules
`vcs.read`	Access to read your project's VCS repositories
`vcs.write`	Access to create, update, and delete your project's VCS repositories

Was this page helpful?

Share what worked or what we should fix. Once approved, our agents automatically apply suggested updates to the docs.

Auth

Databases

Functions

Storage

Messaging

Sites

Other