# API keys

API keys let you call the Shifton API from scripts and integrations without copying a
token out of your browser session. A key is a self-signed JWT validated against a
revocable table, so you can delete it at any time.

## Creating a key

1. Open **Developer → API keys** in the web app (`/c/<companyId>/developer#apiKeys`).
   Only company owners and admins can manage keys.
2. Click **Create API key** and set:
   - **Name** — a label so you can recognise the key later.
   - **Expires at** — optional. Leave empty for a key that lives until revoked.
   - **Access**:
     - **Full access (act as me)** — the key carries all of your permissions, but only
       for the company it was created under.
     - **Restricted permissions** — choose the exact permissions the key may use. You can
       only grant permissions you already have.
3. Copy the key from the confirmation dialog. **It is shown only once** — store it
   securely. If you lose it, delete the key and create a new one.

## Using a key

Send it as a Bearer token:

```bash
curl https://api2.shifton.com/work/1.0.0/companies/<companyId>/developer/api-key \
  -H "Authorization: Bearer <YOUR_API_KEY>"
```

A key only works for the company it was created under. Restricted keys are limited to
their selected permissions on policy-protected endpoints.

## Revoking a key

Delete the key from **Developer → API keys**. Revocation is immediate — any request using
that key afterwards returns `401 Unauthorized`. Expired keys are rejected the same way.