# Managing Agent Keys

> Source: https://docs.trailspark.ai/docs/agent-keys

## Overview

An **agent key** lets an AI agent authenticate directly with your workspace, without a person signed in. You create the key, choose its permissions, and paste it into the agent's configuration. Keys look like `tsk_…` and belong to a single workspace.

You manage keys under **Settings** > **Agent Access**. Only organization admins can create or revoke them.

## Creating an agent key

In the **Create an agent key** card:

1. **Name** — a descriptive label so you can recognize the key later (for example, *Claude Desktop* or *Support Agent*).
2. **Permissions** — check any combination of **Read**, **Configure**, and **Data corrections**. See [Agent Access Overview](/docs/agent-access-overview#permissions) for what each one allows. Grant only what the agent needs.
3. **Allow this key to trigger account re-evaluation (billable)** — leave off unless the agent should be able to re-score accounts. When on, set a **Daily re-evaluation limit** to cap how many accounts it can re-score per day.
4. **Expiration date (optional)** — pick a date for the key to stop working, or leave it blank for a key that never expires.

Click **Create agent key**.

> [!WARNING]
> Copy your agent key immediately. The full `tsk_…` value is shown only once, in the reveal dialog right after you create the key. TrailSpark stores only the last four characters and can never show the full key again. If you lose it, revoke the key and create a new one.

## Viewing your keys

Each key appears as a card under **Agent keys**, showing:

| Field | Description |
|---|---|
| **Name** | The label you gave the key |
| **Key** | The last four characters only, shown as `tsk_…XXXX` |
| **Permissions** | The permission badges for this key |
| **Created** | When the key was created |
| **Last used** | When an agent last authenticated with the key, or *Never* |
| **Status** | **Active**, **Expired** (past its expiration date), or **Revoked** |

## Revoking a key

To turn off a key, click **Revoke** on its card and confirm.

> [!WARNING]
> Revoking is immediate and permanent. Any agent using that key loses access right away. If the agent still needs access, create a new key for it.

## Giving a key to an agent

Once you've copied the `tsk_…` value, add it to your agent as a bearer token — most agents have a field for an API key or authorization token. To connect an agent through a browser approval flow instead of pasting a key, see [Connecting an AI Agent](/docs/connect-an-agent).