# API keys and session keys

> Give each AI agent exactly the access it needs. Keys scoped to read, paper or live, to projects and tools, with an expiry and daily spend caps, rotated with a grace period and revoked in one click.

## API keys

Make a key on the **AI & API** page. It's shown once (`fwb_at_…`); a client sends it as `Authorization: Bearer fwb_at_…`. Each key has:

| Setting | Limits |
|---|---|
| Access | `read` (look only), `paper` (trade on paper) or `live` (trade real money) |
| Projects | Only these projects |
| Tools | Only these tools |
| Expiry | An hour, a day, a week, a month, or never |
| Spend caps | ETH a day, and signatures a day, across everything the key does |

## Session keys for sub-agents

An agent can make **session keys** for agents it runs: narrower, shorter-lived keys that can never have more than their parent. Revoking a key revokes every key made from it, and a key's spending counts against its parents' caps too.

```sh
ftw-trade keys create scout --access paper --projects p_1 --expires 1d --eth-per-day 0.05 --save-as scout
ftw-trade keys list
ftw-trade keys rotate          # a new secret, the old one valid for a grace period
ftw-trade keys revoke <id>
```

## OAuth connections

Apps connected by OAuth (Claude, ChatGPT, Claude Code, Codex) appear on the same page with their live-trading permission, and can be revoked there.

## If a key leaks

Revoke it on the AI & API page. **Account → Security → Sign out everywhere else** also revokes every API key at once.