> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endprompt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin API Keys

> Create and manage Admin API keys for programmatic access

The Admin API uses a separate key type from the endpoint execution keys. Admin keys give you management access to create, update, and delete resources.

## Key Types

Endprompt has two types of API keys:

| Key Type         | Prefix | Purpose                                            |
| ---------------- | ------ | -------------------------------------------------- |
| **Endpoint Key** | `ep_`  | Execute endpoints only — for your application code |
| **Admin Key**    | `epa_` | Full management access — for Admin API and MCP     |

<Note>
  Admin keys can also execute endpoints, so you only need one key for both management and execution during development.
</Note>

## Creating an Admin API Key

<Steps>
  <Step title="Open API Keys">
    Click **API Keys** in the sidebar navigation of your dashboard.
  </Step>

  <Step title="Click Create API Key">
    Click the **Create API Key** button.
  </Step>

  <Step title="Select Admin Type">
    Under **Key Type**, select **Admin**. This creates a key with the `epa_` prefix.
  </Step>

  <Step title="Set Permission Level">
    Choose a permission level:

    * **ReadWrite** — Full access to all operations (create, update, delete, read)
    * **ReadOnly** — Can only read resources (GET operations). Write attempts return 403.
  </Step>

  <Step title="Name Your Key">
    Give it a descriptive name:

    * `MCP - VS Code`
    * `CI/CD Pipeline - Admin`
    * `Development - Local Admin`
  </Step>

  <Step title="Copy the Key">
    Copy the displayed key immediately — you won't see it again.
  </Step>
</Steps>

<Warning>
  Admin API keys are shown only once at creation. Store them securely. If you lose a key, create a new one and revoke the old one.
</Warning>

## Using Your Admin Key

Admin keys work with both the REST API and MCP server. Include the key in your requests:

### REST API (x-api-key header)

```bash theme={null}
curl -X GET https://api.endprompt.app/admin/v1/endpoints \
  -H "x-api-key: epa_your_admin_key_here"
```

### REST API (Bearer token)

```bash theme={null}
curl -X GET https://api.endprompt.app/admin/v1/endpoints \
  -H "Authorization: Bearer epa_your_admin_key_here"
```

### MCP Server

MCP connections use the Bearer token format in the transport configuration. See [MCP Server](/admin-api/mcp-server) for setup details.

## Permission Matrix

| Operation            | ReadWrite | ReadOnly |
| -------------------- | --------- | -------- |
| List / Get resources | ✅         | ✅        |
| Create resources     | ✅         | ❌ (403)  |
| Update resources     | ✅         | ❌ (403)  |
| Delete resources     | ✅         | ❌ (403)  |
| Execute endpoints    | ✅         | ✅        |
| View logs & stats    | ✅         | ✅        |

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Separate Keys by Environment" icon="layer-group">
    Use different admin keys for development, staging, and production.
  </Card>

  <Card title="Use ReadOnly Where Possible" icon="lock">
    If you only need to read data (monitoring, reporting), use a ReadOnly key.
  </Card>

  <Card title="Store Keys Securely" icon="vault">
    Use environment variables or secret managers. Never commit keys to git.
  </Card>

  <Card title="Rotate Periodically" icon="arrows-rotate">
    Create new keys, update your integrations, then revoke old keys.
  </Card>
</CardGroup>