> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usealmanac.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and permissions

> Create a workspace-scoped key and grant only the operations an integration needs.

Almanac API keys are workspace-scoped. Read-only is the default.

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
almanac keys create "Search service" --workspace acme
```

The full `waka_...` secret appears once. Store it in a secret manager. Later list
output shows a separate API key ID and obfuscated value; deletion uses the API
key ID.

## Grant write access deliberately

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
almanac keys create "Wiki automation" --workspace acme --write
```

| Permission               | Allows                                                 |
| ------------------------ | ------------------------------------------------------ |
| `almanac:wiki:read`      | List, search, and read wikis, pages, sources, and jobs |
| `almanac:wikis:create`   | Create wikis                                           |
| `almanac:sources:upload` | Upload source files                                    |
| `almanac:jobs:garden`    | Start Garden jobs                                      |

`--write` grants all four permissions. For a narrower key, repeat `--permission`
with only the required values.

## Send the bearer token

<Tabs>
  <Tab title="HTTP">
    ```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
    curl "$ALMANAC_API_URL/v1/me" \
      -H "Authorization: Bearer $ALMANAC_TOKEN"
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={"theme":{"light":"github-light","dark":"vesper"}}
    import os
    from almanac import AlmanacClient

    client = AlmanacClient(access_token=os.environ["ALMANAC_TOKEN"])
    ```
  </Tab>

  <Tab title="CLI">
    ```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
    almanac --token "$ALMANAC_TOKEN" whoami
    ```
  </Tab>
</Tabs>

Do not put keys in committed files, command examples with real secrets, client-side
browser code, or screenshots. See [Configuration](/reference/configuration) for
the supported environment variables.