# API keys & access

> Create, inject, and revoke credentials for your own workspace.

## One key for your agent's workspace.

Create a named key in your signed-in account. Give each agent or environment its own key so you can revoke it independently.

[Open API-key management](https://studio.datxanhmientrung.ai/?settings=agents)

- Open Settings → Agent access and create a key with a recognizable name.
- Copy the secret when shown. The list keeps metadata, not retrievable raw keys.
- Store it in your agent's secret manager or environment as `DESIGN_STUDIO_API_KEY`.
- Use the key ID to revoke it from Settings, CLI, or REST when access is no longer needed.

```
# DESIGN_STUDIO_API_KEY is supplied by your environment.
dsa tokens list
dsa tokens revoke TOKEN_ID
```

## Know which credential you are using

| Credential | Purpose | Management |
| --- | --- | --- |
| Application API key | Agent access to your studio account and projects. | Settings → Agent access; named, hashed at rest, revocable. |
| Provider BYOK key | Authorize paid text/image/audio/video calls to your provider. | Settings → provider connections; encrypted at rest, masked on reads. |
| MCP OAuth token | Scoped client authorization to project workflows. | OAuth consent/refresh/revocation; cannot manage permanent credentials. |
| Browser session | Signed-in human UI and browser WebMCP. | HttpOnly cookie; cookie writes check the trusted Origin. |

**Try authenticated requests in the REST playground** The REST playground can use a key held only in page memory, or your signed-in session. Executing a write changes the selected project. Clear the key after use. Never paste them into design prompts, public documents, source control, or published snapshots.