> ## Documentation Index
> Fetch the complete documentation index at: https://www.onyxresearch.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings and API Keys

> Manage team-scoped API access for automation and SDKs.

The **Settings → API Keys** page manages team-scoped API access for automation,
CI, and external SDKs. Interactive CLI devices are managed separately under
**Settings → Account → CLI Sessions**.

## Recommended: CLI Login

```bash theme={"theme":{"light":"github-dark-dimmed","dark":"github-dark-dimmed"}}
onyx login
```

Onyx uses a refreshable WorkOS public-client session for interactive login; it
does not generate an API key. Desktop login uses browser PKCE and SSH/headless
login uses a device code. Revoke logged-in devices from Settings → Account.

Revocation is enforced by Onyx, not by the identity provider: every CLI request
must name its own session, and creating a new session requires a fresh login
that Onyx can verify (a browser login carrying a one-time nonce, or a device
login whose code exchange Onyx completed itself), so a revoked device cannot
rebind itself with a stored refresh token. Revoking takes effect within 30 seconds (authenticated sessions are cached
briefly per server instance). Other devices signed in with the same account are
unaffected.

## Environment Overrides

Use direct overrides for scripts or CI jobs:

```bash theme={"theme":{"light":"github-dark-dimmed","dark":"github-dark-dimmed"}}
export ONYX_API_KEY="onyx_..."
export ONYX_API_URL="https://app.onyxresearch.ai"
onyx status
```

## Key Actions

| Action | Effect |
| - | - |
| Create | Shows a one-time secret for the selected team. |
| Rotate | Invalidates the old secret and shows a new one-time secret. |
| Revoke | Stops the key from authenticating. |

Store secrets in a password manager, shell secret store, or CI secret manager. Onyx only shows the secret once.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.