> For the complete documentation index, see [llms.txt](https://docs.paradime.io/app-help/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.paradime.io/app-help/developers/api-keys.md).

# API Keys

Paradime supports two types of API keys to authenticate calls to the Paradime API:

<table><thead><tr><th width="200"></th><th>Account API Keys</th><th>Workspace API Keys [legacy]</th></tr></thead><tbody><tr><td><strong>Scope</strong></td><td>One or more workspaces in your account</td><td>A single workspace</td></tr><tr><td><strong>Authentication</strong></td><td><code>Authorization: Bearer</code> token</td><td><code>X-API-KEY</code> and <code>X-API-SECRET</code> headers</td></tr><tr><td><strong>Workspace selection</strong></td><td>Per request, using the <code>X-Paradime-Workspace</code> header</td><td>Fixed — bound to the workspace where the key was generated</td></tr></tbody></table>

{% hint style="info" %}
**Account API keys are the recommended way to authenticate with the Paradime API.**

A single account API key can access multiple workspaces, so you no longer need to generate and manage a separate set of credentials for each workspace. Workspace API keys remain fully supported for existing integrations.
{% endhint %}

### Capabilities

Both key types grant access through the same set of capabilities (scopes). When generating a key you choose which capabilities to grant it.

| Capabilities                       | Description                                                                                                                                              |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Audit logs viewer**              | This permission grants access to view and export Audit Logs.                                                                                             |
| **Bolt schedules admin**           | This permission grants access to create and delete Bolt schedules, trigger and cancel Bolt runs, as well as access to Bolt schedules and runs' metadata. |
| **Bolt schedules metadata viewer** | This permission grants access to Bolt schedules and runs' metadata.                                                                                      |
| **Catalog admin**                  | This permission grants access to refresh dbt™ docs in the Paradime Catalog.                                                                              |
| **DinoAI agent API**               | This permission grants access to trigger DinoAI agent runs and read their output.                                                                        |
| **Custom integrations admin**      | This permission grants access to create and manage custom integrations.                                                                                  |
| **User management admin**          | This permission grants access to invite, disabling, updating users in a workspace, as well as listing users' metadata.                                   |
| **User metadata viewer**           | This permission grants access to view users' metadata.                                                                                                   |
| **Workspace metadata viewer**      | This permission grants access to view the account workspaces' metadata.                                                                                  |

For an **account API key**, the granted capabilities apply to every workspace the key has access to. For a **workspace API key**, they apply to the single workspace the key belongs to.

***

## Account API Keys

{% hint style="info" %}
**Account API keys are generated at the account level.**

A single account API key can be granted access to one or more workspaces in your Paradime account. You select the target workspace on each API request using the `X-Paradime-Workspace` header — so you no longer need separate credentials for each workspace.
{% endhint %}

### Generate a new account API key

To generate an account API key, navigate to the **Settings** screen and select **API Keys** from the left panel. Click on **Generate API Key**.

{% hint style="warning" %}
Only workspace admins can generate account API keys, and a key can only be granted access to workspaces where you are an admin.
{% endhint %}

Here you will be able to:

* Provide a human readable name to help identify what the API key is generated for
* Set an optional expiration date, after which the key will no longer be valid
* Grant a set of capabilities or scopes to the API key
* Select one or more workspaces the API key can access

<div data-with-frame="true"><figure><img src="/files/VamA7WMRXn4BrjOuP86j" alt=""><figcaption></figcaption></figure></div>

{% hint style="warning" %}
Make sure to store your API key securely in a password manager like 1Password/Lastpass/Dashlane.

After refreshing/leaving this screen you won't be able to retrieve the API key again.
{% endhint %}

### Authenticate with your account API key

Account API keys use **Bearer token** authentication. On each request, pass:

* The `Authorization` header with your account API key (starting with `prdm_cmp_`)
* The `X-Paradime-Workspace` header with the `workspace_token` of the workspace you want the request to run against

The API endpoint is displayed when you generate the key. To find your `workspace_token`, see Company & Workspace token.

{% tabs %}
{% tab title="cURL" %}

```bash
curl -X POST "https://api.paradime.io/api/v1/<company_token>/graphql" \
  -H "Authorization: Bearer prdm_cmp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "X-Paradime-Workspace: <workspace_token>" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { listWorkspaces { workspaces { name uid } } }"}'
```

{% endtab %}

{% tab title="Python" %}

```python
import requests

api_endpoint = "https://api.paradime.io/api/v1/<company_token>/graphql"
api_token = "prdm_cmp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
workspace_token = "<workspace_token>"

response = requests.post(
    api_endpoint,
    json={"query": "query { listWorkspaces { workspaces { name uid } } }"},
    headers={
        "Authorization": f"Bearer {api_token}",
        "X-Paradime-Workspace": workspace_token,
        "Content-Type": "application/json",
    },
)
print(response.json())
```

{% endtab %}
{% endtabs %}

To run the same operation against a different workspace, keep the same Bearer token and change the `X-Paradime-Workspace` header to the other workspace's `workspace_token`. The API key must have been granted access to that workspace, otherwise the request will be rejected.

{% hint style="info" %}
Account-wide operations that are not tied to a specific workspace (for example listing the workspaces in your account) can be called without the `X-Paradime-Workspace` header.
{% endhint %}

### View existing account API keys

To view all active account API keys, navigate to the **Settings** screen and select **API Keys** from the left panel.

For each API key you can see its name, the workspaces and capabilities it has been granted, when it was created, when it was last used, and its expiration date (if set).

### Revoke account API keys

To revoke an account API key, navigate to the **Settings** screen and select **API Keys** from the left panel. Select the API key you want to revoke and choose the delete option.

{% hint style="warning" %}
Please note that this action is irreversible, and any API calls made using the revoked API key will fail.
{% endhint %}

***

## Workspace API Keys \[legacy]

{% hint style="warning" %}
**Workspace API keys are a legacy feature.** They remain fully supported for existing integrations, but we recommend using **Account API Keys** (above) for new integrations — a single Bearer token that can access multiple workspaces in your account.

The key differences from account API keys: a workspace key is scoped to a **single workspace**, authenticates using the `X-API-KEY` and `X-API-SECRET` headers (not a Bearer token), and is bound to the workspace where it was generated (no `X-Paradime-Workspace` header). If you use multiple workspaces, you need a separate set of workspace credentials for each one.
{% endhint %}

{% hint style="info" %}
**Workspace API keys in Paradime are generated at a workspace level.**

If using multiple workspaces you will need to use different API credentials in the Authorization headers.
{% endhint %}

### Generate a new set of API keys

To generate API credentials for making API calls in Paradime, navigate to the *Settings* screen and select *Workspace Settings* from the left panel. Scroll to the bottom of the screen and click on **Generate API Keys**.

Here you will be able to:

* Provide a human readable name to help identify what is the API key generated for
* Set an optional lifetime in days for the API keys, after the credentials will expire those will not be valid
* Grant a set of capabilities or scopes to the API keys

{% hint style="warning" %}
Make sure to store your API credentials securely in a password manager like Lastpass/Dashlane.

After refreshing/leaving this screen you wont be able to retrieve the API keys again.
{% endhint %}

#### Authenticate with your workspace API keys

Workspace API keys authenticate using two request headers — `X-API-KEY` and `X-API-SECRET` — posted to your workspace's API endpoint. Unlike account API keys, there is no `Authorization: Bearer` token and no `X-Paradime-Workspace` header: the key is already bound to a single workspace.

{% tabs %}
{% tab title="cURL" %}

```bash
curl -X POST "<API_ENDPOINT>" \
  -H "X-API-KEY: <YOUR_API_KEY>" \
  -H "X-API-SECRET: <YOUR_API_SECRET>" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { ... }"}'
```

{% endtab %}

{% tab title="Python" %}

```python
import requests

response = requests.post(
    "<API_ENDPOINT>",
    json={"query": "query { ... }"},
    headers={
        "X-API-KEY": "<YOUR_API_KEY>",
        "X-API-SECRET": "<YOUR_API_SECRET>",
        "Content-Type": "application/json",
    },
)
print(response.json())
```

{% endtab %}
{% endtabs %}

### View existing API keys details

To view all active account API keys, navigate to the **Settings** screen and select **API Keys** from the left panel.

For each API key you can see its name, capabilities it has been granted, when it was created, when it was last used, and its expiration date (if set).

### Revoke account API keys

To revoke an account API key, navigate to the **Settings** screen and select **API Keys** from the left panel. Select the API key you want to revoke and choose the delete option.

{% hint style="warning" %}
Please note that this action is irreversible, and any API calls made using the deleted API key will fail.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.paradime.io/app-help/developers/api-keys.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.