---
title: How to create API keys
description: Learn how to generate API keys for secure access to Scaleway services.
tags: verification identity account
dates:
  validation: 2025-07-15
  posted: 2022-06-20
---
import Requirements from '@macros/iam/requirements.mdx'

API keys are unique identifiers necessary to use the [Scaleway API](https://www.scaleway.com/en/developers/api/). You generate them via the Scaleway console, either for your own IAM user or for an [IAM application](/iam/concepts/glossary/#application).

An API key inherits the permissions of its bearer, which is the IAM user or IAM application it is associated with. The key grants exactly the rights defined for that bearer in the Organization via [policies](/iam/concepts/glossary/#policy).

Each API key is scoped to a single [Organization](/iam/concepts/glossary/#organization). If you belong to several Organizations, you need a separate API key for each one. A user or application can hold multiple API keys within the same Organization.

You can generate API keys for your own user, but not for other IAM users, regardless of your permissions. To generate API keys for an IAM application, you must be the Organization Owner or have the [IAMManager or IAMApplicationManager permissions](/iam/policies-permissions/permission-sets/).

API keys attached to your own user are suitable for testing and accessing your infrastructure. For long-lived keys, such as those used in production, Scaleway recommends using an IAM application as the bearer. Because applications are non-human users, their API keys are not affected if a member leaves or is removed from the Organization.

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)

1. Click **IAM & API keys** on the top-right drop-down menu of the Scaleway console. You are taken to your [Identity and Access Management dashboard](https://console.scaleway.com/iam/users).

2. Click the **API keys** tab.
3. Click **+ Generate API key**. The following screen pops up:
4. Select the **bearer** of the API key. Choose between yourself (as an IAM user), or an [IAM application](/iam/concepts/glossary/#application) associated with the Organization.
5. Enter an optional **description** for the API key.
6. Enter the desired **expiration**. Choose from:
    - **Never**: the API key will never expire,
    - **1 hour / week / month / year**: the API key will expire at the end of the selected period,
    - **Custom**: you are prompted to enter a **date** on which the API key will expire.

7. Select whether the API key will be used for Object Storage. Choose from:
    - **Yes, set up preferred Project**: you are prompted to select a [Project](/iam/concepts/glossary/#project) that the API key will always use for Object Storage operations.
    - **No, skip for now**: the Project that you are currently navigating in the console (i.e. the one that is selected in your [Project dashboard](/organizations-and-projects/concepts/glossary/#project-dashboard)) will be automatically selected as the preferred Project for Object Storage.

    <Message type="note">
      Preferred Projects for Object Storage - When creating and/or listing Object Storage buckets via the API, there is no available parameter to specify the Project in which you wish to list or create buckets. All buckets you create via the API will therefore be created in the preferred Project you choose when creating the API key. Similarly, when listing buckets, buckets from your preferred Project will be listed.
      Note that:
        - This applies to all actions on Object Storage buckets, but it does not apply to other products or resources.
        - You can still create and/or list buckets in your Project of choice via the Scaleway console.
      See our [dedicated documentation](/iam/api-cli/using-api-key-object-storage/) for more information.
    </Message>

8. Click **Generate API key**. A screen displays showing the access key and secret key for your new API key and reminding you that this is your only chance to securely save the secret key.
9. Ensure you have securely saved the secret key, then close the window. You are returned to the **API keys** tab, where your new API key now appears in the list.