# Create and use API keys

> Create a KickBot API key for your scripts and agents, choose read only or read and write access, set an expiry, and revoke the key when you are done.

Source: https://kickbot.com/docs/api/start/api-keys

A KickBot API key lets a script or agent use the KickBot API and MCP server as you, on one channel. You create keys on the **API & MCP** page of the dashboard. A key has your team permissions on that channel, and nothing more.

## Create a key

1. Open [kickbot.com/dashboard/api](https://kickbot.com/dashboard/api). In the sidebar it is **API & MCP**, under **Account**.
2. Click **Create key**.
3. Enter a **Name** you will recognize later, for example "Stream stats script". Only you see it.
4. Choose the **Access**: **Read and write** (read and change your KickBot settings) or **Read only** (only read settings and data).
5. Choose when the key **Expires**: **Never**, 7, 30, 60, 90 or 180 days, 1 year, 2 years, or a **Custom date** (up to 10 years).
6. Click **Create key** and copy the key.

> **Caution:** KickBot shows the full key only once. Store it in a password manager or an environment variable. Do not paste it into an AI chat or commit it to a code repository.

The key starts with `kb_live_`. After you close the popup, the dashboard shows only the first characters, so you can tell keys apart. To change the name or the access of a key, create a new key and revoke the old one.

## Use a key

Send the key in the `Authorization` header of every request:

```bash
curl https://kickbot.com/api/v1/account \
  -H "Authorization: Bearer $KICKBOT_API_KEY"
```

The same header works for the MCP server at `https://kickbot.com/api/v1/mcp`. See [Build your own agent](https://kickbot.com/docs/api/start/build-an-agent).

## Team members

The channel owner and admins can always create keys. Moderators need the **API & MCP access** permission, which the owner or an admin turns on in **Manage Team**. See [Team](https://kickbot.com/docs/account/team).

A team member's key can do only what that member can do in the dashboard. If you remove a team member, or take away a permission, their keys lose that access at once.

Each team member can have up to 20 active keys per channel.

## Revoke a key

1. Open **API & MCP** in the dashboard.
2. Click the key in the list, then click **Revoke**.
3. Click **Revoke key** in the popup.

Scripts and apps that use the key stop working at once. You cannot undo this. Owners and admins can revoke any key on the channel.

## FAQ

**Can I use one key for two channels?**

No. A key belongs to one channel. If you manage more than one channel, switch channels in the dashboard and create a key for each. See [Multiple channels](https://kickbot.com/docs/account/multiple-channels).

**Is my Stream Deck key the same as an API key?**

No. The Stream Deck plugin uses its own key from **Settings**. API keys are separate, and creating or revoking one does not affect the Stream Deck. See [Stream Deck](https://kickbot.com/docs/integrations/stream-deck).

**What do I do if my API key leaks?**

Revoke it right away on the **API & MCP** page and create a new one. Then check **Recent API activity** on the same page to see what the key changed.