# cs keys (/docs/cli/keys)

`cs keys` manages your **member API keys**. A key acts as the member who
created it — same connections, same role — and is what belongs in a
configuration file that outlives a session. How member and agent keys differ is
on [Authentication](/docs/authentication#api-keys).

## Usage \[#usage]

```bash
cs keys create <name>   # mints an sk-cs- key; the secret is shown once
cs keys list
cs keys rotate <id>     # new secret under a new id; name, cap, and usage carry over
cs keys revoke <id>
```

## create \[#create]

`cs keys create` mints a key named `<name>` and prints the secret once. Save it
now; it cannot be shown again.

```text title="Output"
API key created (shown once — save it now):

  sk-cs-…

  id: 3f9c1e0a-7b2d-4c58-9e11-0d6f2a8b4c73
```

The CLI creates keys without a spend cap or expiry. Set either in
[Dashboard → API keys](https://app.corespeed.io/keys).

## list \[#list]

`cs keys list` prints the API response as JSON: a `data` array of keys with
id, name, the last four characters, spend cap, lifetime and current-month
usage, expiry, and timestamps — never the secret.

```bash
cs keys list | jq '.data[] | {id, name, last_4}'
```

## rotate \[#rotate]

`cs keys rotate <id>` revokes the key and mints a replacement under a **new
id**, carrying over the name, spend cap, usage, and expiry. The old secret stops
working immediately; the new secret and id are printed once as JSON, so update
anything that references the old id.

## revoke \[#revoke]

`cs keys revoke <id>` invalidates the key. Requests that still carry it answer
`401 invalid_api_key`.