# API keys

Keys for scripts, CI and the REST API.

Interactive agents should [sign in](/docs/agents/connect) instead; keys are for code that runs without you.

## Create a key

In **Settings → Agents**, click **API key**, name it after where it will live (for example "CI tour sync"), and choose whether it **Can publish**. Copy the key when it's shown: it's displayed **once**. GuideMark stores only a hash, so a lost key can't be recovered; revoke it and create another.

Keys look like `gm_` followed by 64 hex characters. Send them as a header:

```bash
curl https://guidemark.co/api/v1/project -H "Authorization: Bearer gm_…"
```

## Scopes

| Scope          | Allows                                                                                                                |
| -------------- | --------------------------------------------------------------------------------------------------------------------- |
| `read`         | list and fetch tours and tooltips                                                                                     |
| `write_drafts` | create drafts; edit or delete anything that isn't live; complete [API checklist items](/docs/reference/checklist-api) |
| `publish`      | publish, unpublish, edit or delete live content, if the project allows agent publishing                               |

Every key has `read` and `write_drafts`.

## Limits and safety

* A key works for **one project**.
* **60 requests per minute** per key; over that, `429` with `Retry-After`.
* Keys don't expire. Revoke unused ones in Settings → Agents; the list shows when each was last used.
* Never put a key in front-end code. It's for servers, CI and your own machine.