---
title: Self-service AccessKeys
description: Create and revoke AccessKeys for your own account from the With portal.
editUrl: true
head: []
template: doc
sidebar:
  order: 3
  hidden: false
  attrs: {}
pagefind: true
draft: false
---

An AccessKey is a long-lived credential that lets a CLI, service, launcher, or other headless client use **your account** with an application that explicitly allows AccessKey direct-issue.

Use AccessKeys only when the client cannot send you through an interactive browser login. For public CLIs and launchers where the user can approve a browser code, [Device Authorization](/en-us/device/flow/) is often the safer fit.

## Before creating a key

Check that:

- The target application is the one you expect.
- The application allows the `ACCESS_KEY_DIRECT` authentication method and `DIRECT_ISSUE` return method.
- You are comfortable with the claims the application requests.
- You can store the generated secret safely. It is not available from later
  key-list or detail reads.

## Create an AccessKey

In [`with.sudomimus.com`](https://with.sudomimus.com):

1. Open **Account → Access keys**.
2. Choose the application.
3. Review the requested claims and consent prompt.
4. Create the key.
5. Store the secret in your password manager, secret store, CI variable, or service configuration.

The key is bound to your own account. It cannot create a new account and it cannot act as another user.

If the network fails while the key is being created, retry without changing the
form. The portal keeps the same operation identifier and can recover that exact
result for up to ten minutes instead of creating a second key. This is recovery
for an uncertain create response, not a general reveal feature; after the
window, replace a lost secret by creating a new key and revoking the old one.

## Consent at creation time

AccessKey clients often run without a browser, so the portal collects claim consent before minting the key. If the application requires your email, name, or avatar, review that request carefully.

If required claim data is missing, complete your profile first. If you deny a required claim, the key cannot be created for that application.

## Revoke or rotate a key

If a key is no longer needed or might have leaked, revoke it from **Account → Access keys**.

Rotation means:

1. Create a new key.
2. Update the client or service to use the new secret.
3. Revoke the old key.

## Related

- [Native flows](/en-us/native/overview/) - how AccessKey direct-issue works at runtime.
- [Native claims and the Errand](/en-us/native/claims-and-errand/) - recovery when a direct-issue flow needs consent or profile data.
- [Identity claims and sharing](/en-us/concepts/identity-claims/) - how claim policy and user grants interact.