---
title: Manage access keys
description: Create, rotate, and revoke access keys for your account, agents,
  and automations.
editUrl: true
head: []
template: doc
sidebar:
  order: 2
  hidden: false
  attrs: {}
pagefind: true
draft: false
---

An access key is a long-lived credential for a service or command-line tool that signs in to a specific application without a browser. It can represent your account or belong to an [agent](/en-us/programmatic-access/agents/) or [automation](/en-us/programmatic-access/automations/) you created.

If a person launches the tool and can approve sign-in in a browser, [Device Authorization](/en-us/device/flow/) is usually a better fit.

## Before you create one

Confirm that:

- you recognize the target application and it accepts access keys for the principal you selected;
- the agent or automation is active, if the key will belong to one; and
- you have a password manager, secret store, or protected runtime environment ready for the secret.

## Create an access key

In [`with.sudomimus.com`](https://with.sudomimus.com):

1. Open **Programmatic access → Access keys**.
2. Select **Create access key** and enter the application anchor.
3. Choose your account, an agent, or an automation as the principal.
4. Review the profile information requested by the application and confirm your choices.
5. Create the key, then copy and store the secret immediately.

The secret is shown once. The portal will continue to show the key name, principal, and usage details, but it cannot reveal the secret later.

If the network drops during creation, keep the form unchanged and retry so the portal can recover the result of the same operation.

## Profile consent

An application may request your name, email, or avatar. That information comes from the owning account even when an agent or automation signs in. Share only what the task needs.

If required profile data is missing, update your profile before trying again. A key cannot be created if you decline information the application requires.

## Rotate or revoke

For a routine rotation, create a replacement and update the service first. Revoke the old key after the service can sign in successfully with the new one.

Revoke a key immediately if it may have leaked. Revocation cannot be undone, and any service using that key will lose access.

## Related

- [Choose a programmatic access method](/en-us/programmatic-access/overview/)
- [Public-key sign-in](/en-us/programmatic-access/public-keys/)
- [Review and end sessions](/en-us/with-portal/session-security/)