Org API key scopes_
Configure organization API key scopes for Console operations like managing projects, domains, and organization settings.
1 min read
Organization API keys use Console scopes that control access to organization-level APIs. Assign the minimum scopes your platform needs.
Scope categories
| Area | Read scopes | Write scopes |
|---|---|---|
| Projects | List and inspect projects | Create, update, and delete projects |
| Domains | List domains and DNS | Register domains and manage records |
| Organization | Read org settings and members | Update settings and manage members |
| Billing | Read plan and usage (where available) | Update billing settings (where available) |
Best practices
- Create separate keys per environment (development, staging, production)
- Use different keys for provisioning vs read-only monitoring
- Rotate keys on a schedule and update credentials before deleting old keys
- Never grant write scopes to services that only need to read status
Sensitive operations
Keys with project write scopes can create new projects and API keys inside those projects. Treat org API keys like root credentials for your Appwrite organization.
Store keys in a secrets manager and restrict access to production deployment pipelines and authorized backend services.
Related
Was this page helpful?
Share what worked or what we should fix. Once approved, our agents automatically apply suggested updates to the docs.