> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squawkvoice.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# API Keys
> Create and revoke the machine-to-machine keys your own systems authenticate with
API keys let your own systems call SquawkVoice without a person signing in. A key is sent as an `X-API-Key` header and acts on behalf of whoever created it.
API keys live in **Studio → Manage → Advanced → API Keys**.
These are keys your systems use to call **into** SquawkVoice. They are not the same thing as [Auth Profiles](/manage/auth-profiles), which hold the credentials your AI agents use to call **out** to your APIs, or the Freshworks keys under [Connected Apps](/manage/connected-apps).
## What a Key Can Do Today
An API key is accepted on the **On-Demand Call API** — placing a campaign call, and cancelling one before it is dialed:
* `POST /api/v1/campaigns/{campaignId}/contacts/on-demand`
* `DELETE /api/v1/campaigns/{campaignId}/contacts/on-demand/{contactId}`
* `DELETE /api/v1/campaigns/{campaignId}/contacts/on-demand/by-request-id/{requestId}`
See [On-Demand Calls](/campaigns/on-demand-calls) for the full request and response reference.
Nothing else in the platform accepts an API key. The same header sent to any other path is not inspected at all, and the request comes back as a plain authorization failure — which reads like a broken key rather than an unsupported endpoint. Everything else, including creating and revoking keys, needs a signed-in Studio session.
There is also no key-authenticated way to read results back. Call outcomes live in the Studio.
## Creating a Key
**Manage → Advanced → API Keys**. You can also get there from the **Manage API Keys** button inside a campaign's **On-Demand Call API** drawer.
Give the key a **Name** — up to 200 characters.
**No expiration**, **1 Year** through **5 Years**, or **Custom** with a date picker. A custom date can be anywhere from tomorrow to five years out.
A **Save Your API Key** dialog shows the key in full, once, with a copy button: "This is the only time you'll be able to see this key."
Keys look like `squawk_sk_live_…`.
**The key value cannot be recovered, and there is no rotate.** Only a hash of it is stored, so nothing — not support, not SquawkVoice staff — can show it to you again. Losing a key means revoking it and creating another, then updating whatever was using it.
**Name keys for the integration that will use them.** The list shows no key value, no prefix and not even the last four characters, so the name you give it is the only way to tell one key from another later.
## The Key List
Each row shows the key's name, when it was created, when it was last used, and its expiry — or **No expiration**. A key past its expiry carries an **Expired** badge; it stays in the list and is rejected at the moment it is used rather than being removed.
Search filters by name. Page sizes are 10, 20 and 50.
The list holds the 500 most recently created keys in scope, and search and paging work over that set. A very large partner scope can therefore have keys that are not listed.
## Who Can See and Revoke Which Keys
This is asymmetric, and it is worth knowing before you need it.
| Your user type | What you see and can revoke |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Account** | Only the keys you created yourself. Not a teammate's, even inside your own account. |
| **Partner** | Every key created by anyone in your scope — your account if your login is tied to one, otherwise every user under your partner. Each row is tagged with its owner, **You** or their name, and you can revoke any of them. |
| **SquawkVoice staff** | The keys belonging to whichever account or partner is selected in the tenancy switcher. |
The key value itself is never shown to anyone but the person who created it, including a partner or SquawkVoice viewer — they see only the name, the owner and the dates.
An account-level administrator **cannot** see or revoke a colleague's key. When someone leaves and their key needs retiring, ask your partner administrator or your SquawkVoice contact to revoke it.
## Revoking a Key
Click the trash icon on a key's row and confirm. Where you are revoking someone else's key, the confirmation names them: "— created by …".
Revocation is immediate and permanent. Any integration still using that key stops working on its very next request, with no grace period, and the action cannot be undone.
## Scope and Least Privilege
**A key carries the authority of whoever created it.** A key created by an account-level user reaches campaigns in that account. A key created by a **partner**-level user reaches campaigns in *every* account beneath that partner.
Two practices follow from that:
* **Create keys as the narrowest user you can.** If an integration only needs one account's campaigns, create its key while signed in as a user of that account.
* **Use one key per integration.** Because revocation is immediate and total, a key shared between two systems cannot be retired from one without breaking the other.
There is currently no way to restrict key creation to administrators — any signed-in Studio user of any user type can create a key for their own scope. If your organization needs that restricted, talk to your SquawkVoice contact.
## Where to go next
The API these keys authenticate, with the full endpoint reference.
Credentials your agents use when calling out to your own APIs.