> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mountthor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Manage credentials for automation

Use API keys for CI and other non-interactive clients. Use browser sign-in for
human sessions. Keys can also be created, rotated, and revoked in the Mount Thor
portal.

## Create a key

```bash theme={null}
mthr keys create --display-name build-agent
```

The default scopes are `sessions:write`, `access:write`, `compute:read`,
`compute:session`, and `compute:write` — enough for compute automation. For a
narrower key, set `--scopes` explicitly:

```bash theme={null}
mthr keys create \
  --display-name vm-runner \
  --scopes "compute:read,compute:session,compute:write"
```

`compute:session` is required for SSH, desktop, and port-forward grants. Add
`account:read` for account reads such as `mthr whoami`, and `billing:read` for
billing reads. Neither is included by default.

Set an expiry when the key has a fixed lifetime:

```bash theme={null}
mthr keys create \
  --display-name release-job \
  --expires-at "2026-12-31T00:00:00Z"
```

The plaintext key is shown once. Store it in a secret manager, then expose it
to `mthr` as `MOUNTTHOR_API_KEY`:

```bash theme={null}
export MOUNTTHOR_API_KEY="mthr_live_..."
```

When both a stored browser session and `MOUNTTHOR_API_KEY` are present, the API
key takes precedence.

## List and update keys

```bash theme={null}
mthr keys ls
mthr keys update build-agent \
  --scopes "sessions:write,compute:read,compute:session"
```

Updating scopes replaces the current set.

## Delete a key

```bash theme={null}
mthr keys delete build-agent
```

Delete unused or exposed keys immediately.