[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Concepts](../index.md) > [Authentication](index.md) > API key

# API key


{% note info %}

Creating API keys for service accounts may be prohibited by [access policies](../access-control/access-policies.md) at the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [organization](../../../organization/concepts/organization.md) level.

{% endnote %}

The _API key_ is a secret key only used for simplified authorization of [service accounts](../users/service-accounts.md) with the Yandex Cloud API.

Use API keys if requesting an [IAM token](iam-token.md) automatically is not an option.

{% note alert %}

If someone might have gotten access to your private key, [delete it](../../operations/authentication/manage-api-keys.md#delete-api-key) and [create a new one](../../operations/authentication/manage-api-keys.md#create-api-key).

{% endnote %}

It is the user's responsibility to store the API key. Yandex Cloud provides access to an API key only during its creation. If the key is lost or damaged, you cannot restore it. In this case, you can [reissue](../../operations/compromised-credentials.md#api-key-reissue) the key or create a new one.

To ensure security and control over access to resources, monitor cases of unauthorized use of keys, and delete unused keys without the risk of disrupting Yandex Cloud services, you can track the dates of last use of service account access keys. You can find this info on the service account page in the [management console](https://console.yandex.cloud) or in the `last_used_at` field when using the API to invoke access key management methods.

## API keys with scope and validity limits {#scoped-api-keys}

When [creating](../../operations/authentication/manage-api-keys.md#create-api-key) an API key, you can specify one or more _scopes_.

A scope is the total of the actions a service account is allowed to perform with the service's resources. A service can have more than one scope. You cannot use an API key with specified scopes in other services or scopes.

The scope limits the use of API keys in addition to the service account's personal access permissions.

Additionally, when creating an API key, you can limit its validity period. You can reduce the risk of unauthorized use of your keys by configuring their scope limits and validity periods.

Available scopes are listed below:


* `yc.ai.foundationModels.execute`: For requests to the [AI Studio API](https://aistudio.yandex.ru/docs/en/ai-studio/concepts/api.html#yc), [SpeechKit API](https://aistudio.yandex.ru/docs/en/speechkit/concepts/api), [Yandex Translate API](https://aistudio.yandex.ru/docs/en/translate/concepts/api), and [Vision OCR API](https://aistudio.yandex.ru/docs/en/vision/ocr/api-ref/index).
* `yc.ai.imageGeneration.execute`: For requests to image generation models in Yandex Cloud AI Studio via the [Image Generation API](https://aistudio.yandex.ru/docs/en/ai-studio/image-generation/api-ref/index).
* `yc.ai.languageModels.execute`: For requests to text generation models in Yandex Cloud AI Studio via the [Text Generation API](https://aistudio.yandex.ru/docs/en/ai-studio/text-generation/api-ref/index).
* `yc.ai.speechkitStt.execute`: To [recognize speech](https://aistudio.yandex.ru/docs/en/speechkit/stt/index) via the [SpeechKit API](https://aistudio.yandex.ru/docs/en/speechkit/concepts/api).
* `yc.ai.speechkitTts.execute`: To [synthesize speech](https://aistudio.yandex.ru/docs/en/speechkit/tts/index) via the [SpeechKit API](https://aistudio.yandex.ru/docs/en/speechkit/concepts/api).
* `yc.ai.translate.execute`: To translate text via the [Yandex Translate API](https://aistudio.yandex.ru/docs/en/translate/concepts/api).
* `yc.ai.vision.execute`: To perform optical text recognition via the [Vision OCR API](https://aistudio.yandex.ru/docs/en/vision/ocr/api-ref/index).
* `yc.datasphere.community-projects.manageResource`: To manage [project](../../../datasphere/concepts/project.md) resources via the [Yandex DataSphere API](../../../datasphere/api-ref/overview.md).
* `yc.logging.write`: To write logs to [log groups](../../../logging/concepts/log-group.md) via the [Yandex Cloud Logging API](../../../logging/api-ref/authentication.md).
* `yc.managed-ytsaurus.cluster.use`: To work with [clusters](../../../managed-ytsaurus/concepts/component-types.md) via the [Yandex Managed Service for YTsaurus API](../../../managed-ytsaurus/api-ref/authentication.md).
* `yc.monitoring.manage`: To view and write data in Yandex Monitoring via the [Monitoring API](../../../monitoring/api-ref/index.md).
* `yc.monitoring.read`: To view data in Yandex Monitoring via the [Monitoring API](../../../monitoring/api-ref/index.md).
* `yc.monium.logs.write`: To write [logs](../../../monium/logs/quickstart.md) to [Monium](../../../monium/index.md).
* `yc.monium.metrics.write`: To write [metrics](../../../monium/metrics/overview.md) to [Monium](../../../monium/index.md).
* `yc.monium.traces.write`: To write [distributed traces](../../../monium/traces/index.md) to [Monium](../../../monium/index.md).
* `yc.monium.telemetry.write`: To write any type of telemetry to [Monium](../../../monium/index.md) over [OTLP](https://opentelemetry.io/docs/specs/otlp/) (OpenTelemetry Protocol).
* `yc.postbox.send`: To send emails via the [Yandex Cloud Postbox](../../../postbox/index.md) API.
* `yc.cloud-registry.artifacts.manage`: To view, publish, and delete artifacts from [Yandex Cloud Registry](../../../cloud-registry/index.md).
* `yc.cloud-registry.artifacts.pull`: To view and download artifacts from [Yandex Cloud Registry](../../../cloud-registry/index.md).
* `yc.cloud-registry.artifacts.push`: To view and publish artifacts in [Yandex Cloud Registry](../../../cloud-registry/index.md).
* `yc.search-api.execute`: To send search queries to [Yandex Search API](https://aistudio.yandex.ru/docs/en/search-api/api-ref/index).
* `yc.serverless.containers.invoke`: To invoke containers via the [Serverless Containers API](../../../serverless-containers/containers/api-ref/index.md).
* `yc.serverless.functions.invoke`: To invoke functions via the [Cloud Functions API](../../../functions/functions/api-ref/index.md).
* `yc.serverless.mcpGateways.invoke`: To invoke MCP servers via the [Yandex Cloud AI Studio MCP Hub](https://aistudio.yandex.ru/docs/en/ai-studio/concepts/mcp-hub/index).
* `yc.serverless.workflows.execute`: To execute [workflows](../../../serverless-integrations/concepts/workflows/execution.md) via the [Workflows API](../../../serverless-integrations/concepts/index.md#workflows).
* `yc.speech-sense.use`: To work with SpeechSense [resources](https://aistudio.yandex.ru/docs/en/speechsense/concepts/resources-hierarchy) via the [Yandex SpeechSense API](https://aistudio.yandex.ru/docs/en/speechsense/api-ref/authentication).
* `yc.ydb.tables.manage`: For accessing YDB in PostgreSQL-compatible mode.
* `yc.ydb.topics.manage`: For accessing the [Kafka API](../../../data-streams/kafkaapi/auth.md) in Yandex Data Streams.

When creating an API key in the [management console](https://console.yandex.cloud), scope is a required parameter. When creating an API key using the [Yandex Cloud CLI](../../../cli/cli-ref/iam/cli-ref/api-key/create.md), [Terraform](../../../terraform/resources/iam_service_account_api_key.md), or [API](../../api-ref/ApiKey/create.md), scope is optional. If you do not specify a scope for the new API key, it will get the following scopes by default:

* `yc.ai.imageGeneration.execute`
* `yc.ai.languageModels.execute`
* `yc.ai.speechkitStt.execute`
* `yc.ai.speechkitTts.execute`
* `yc.ai.translate.execute`
* `yc.ai.vision.execute`
* `yc.monitoring.manage`
* `yc.search-api.execute`
* `yc.serverless.containers.invoke`
* `yc.serverless.functions.invoke`

## Identifying an API key {#identify-key}

The [list](../../operations/authentication/manage-api-keys.md#list-api-keys) of API keys in the Yandex Cloud CLI includes the `MASKED KEY` field which shows the last six characters of the key’s secret part. This helps you match the API key to its ID. Displaying the six characters is secure as the entire key is not revealed.

Use the `MASKED KEY` field to quickly identify a key, e.g., when searching for a key in leak databases or mapping keys in other systems with keys in Yandex Cloud.

## Using an API key {#use}

Enter your API key when accessing Yandex Cloud resources via the API. Provide the API key in the `Authorization` header in the following format:

```
Authorization: Api-Key <API_key>
```

## Services that support this authentication method {#supported-services}

The following services support authentication based on API keys:

* [Yandex Cloud AI Studio](https://aistudio.yandex.ru/docs/en/ai-studio/api-ref/authentication)
* [Yandex Cloud Functions](../../../functions/operations/function/auth.md)
* [Yandex DataSphere](../../../datasphere/api-ref/authentication.md)
* [Yandex Monitoring](../../../monitoring/api-ref/authentication.md)
* [Yandex Cloud Postbox](../../../postbox/api-ref/authentication.md)
* [Yandex Search API](https://aistudio.yandex.ru/docs/en/search-api/api-ref/authentication)
* [Yandex Serverless Containers](../../../serverless-containers/index.md)
* [Yandex Serverless Integrations](../../../serverless-integrations/index.md): Within [Yandex Workflows](../../../serverless-integrations/concepts/workflows/workflow.md).
* [Yandex SpeechKit](https://aistudio.yandex.ru/docs/en/speechkit/concepts/auth)
* [Yandex SpeechSense](https://aistudio.yandex.ru/docs/en/speechsense/api-ref/authentication)
* [Yandex Translate](https://aistudio.yandex.ru/docs/en/translate/api-ref/authentication)
* [Yandex Vision OCR](https://aistudio.yandex.ru/docs/en/vision/api-ref/authentication)
* Yandex Data Streams: [Kafka API](../../../data-streams/kafkaapi/index.md).
* Yandex Managed Service for YDB: Only in PostgreSQL-compatible mode. Use a suitable [authentication method](../../../ydb/operations/connection.md#auth) for other modes.
* [Yandex MetaData Hub](../../../metadata-hub/concepts/index.md): Within [Yandex Schema Registry](../../../metadata-hub/operations/connect-to-namespace.md).
* [Yandex Cloud Registry](../../../cloud-registry/index.md)

## Use cases {#examples}

* [Automatic data upload to Yandex SpeechSense using Yandex Workflows](../../../tutorials/ml-ai/speechsense/auto-upload.md)

#### Useful links {#see-also}

* [Creating an API key](../../operations/authentication/manage-api-keys.md#create-api-key)
* [IAM token](iam-token.md)
* [How to choose a suitable authentication method in Yandex Cloud](index.md)