# API key scope

Canonical page: /glossary/api-key-scope

API keys & secrets glossary, Keys & secrets. API Key Scope: Limiting What a Key Can Do

**Short answer:** An API key's scope is the specific set of actions or resources it is allowed to touch, as opposed to a key with full account access. Many services let you create a key scoped to, for example, read-only access, or access to a single project rather than every project on the account.

## Why it matters

Scoping a key does not stop a leak from happening, but it puts a ceiling on what someone can do with it, which is usually the most practical protection available for a key that has to exist somewhere.

## In Claude Keychain

Claude Keychain does not create or scope keys itself, that happens on the provider's side, but it does make it painless to store several narrowly scoped keys instead of one broad one, since adding another key is as easy as the first.

## Common questions

**Should I always use the most limited scope available?**

As a default, yes. Widen it only when something you are actually doing needs the extra access.

**Can I change a key's scope after creating it?**

Depends on the provider. Some let you edit permissions in place, others require generating a new key with the scope you want.

## Related

[Principle of least privilege](/glossary/least-privilege), [API key](/glossary/api-key), [Revoking an API key](/glossary/revoke-api-key)