> This page location: APIs & SDKs > CLI > Setup and context > api-keys
> Full Neon documentation index: https://neon.com/docs/llms.txt

> Summary: The `neon api-keys` CLI command manages API keys for your account, an organization, or a single project. Use it to create a key for scripts and CI, list existing keys and when they were last used, and revoke a key you no longer trust.

# Neon CLI command: api-keys

Create, list, and revoke Neon API keys

The `api-keys` command creates, lists, and revokes the API keys that authenticate requests to the Neon API. Keys belong to your account unless you pass `--org-id` or `--project-id`.

A key is shown once, at creation. There is no way to retrieve it later.

For key types, revocation permissions, and rotation, see [Manage API keys](https://neon.com/docs/manage/api-keys).

Subcommands: [create](https://neon.com/docs/cli/api-keys#create), [list](https://neon.com/docs/cli/api-keys#list), [revoke](https://neon.com/docs/cli/api-keys#revoke)

## neon api-keys list

Lists key metadata, never the keys themselves.

```bash
neon api-keys list [options]
```

| Option     | Description                                            | Type   | Default | Required |
| ---------- | ------------------------------------------------------ | ------ | ------- | :------: |
| `--org-id` | List the organization's keys instead of your account's | string | —       |    No    |

List your account keys:

```bash
neon api-keys list
```

```text filename="Output"
Account API keys
ID       Name       Created At            Last Used At          Last Used From Addr
3225782  ci-deploy  2026-07-29T00:50:26Z  2026-07-29T18:06:55Z  192.0.2.10
```

Organization keys are invisible to your account, so listing them needs `--org-id`:

```bash
neon api-keys list --org-id org-example-12345678
```

This covers both scopes, since a project-scoped key is owned by the project's organization. The `Project` column tells them apart:

```text filename="Output"
API keys in org-example-12345678
ID       Name         Project                Created At            Last Used At          Last Used From Addr
3243240  preview-bot  green-breeze-12345678  2026-08-04T18:51:36Z  2026-08-05T18:51:36Z  192.0.2.10
3177950  org-key      (all projects)         2026-07-08T01:28:49Z  2026-07-08T01:31:20Z  192.0.2.10
```

`(all projects)` is a table label only. In JSON and YAML the field is `project_id`, and it is `null` for an organization-wide key:

```bash
neon api-keys list --org-id org-example-12345678 -o json
```

```json
[
  { "id": 3243240, "name": "preview-bot", "project_id": "green-breeze-12345678" },
  { "id": 3177950, "name": "org-key", "project_id": null }
]
```

## neon api-keys create

Creates a key and prints it once. `--name` is required.

By default the key reaches everything your account can, in every organization. Two mutually exclusive flags change that:

- `--project-id` limits the key to one project. Use this for anything deployed, so a leaked key cannot reach your other projects.
- `--org-id` transfers ownership to an organization. This is not a restriction: the key reaches every project in that organization, including ones created later.

Both organization forms need organization admin permissions. Each form prints a notice describing what the key can reach.

```bash
neon api-keys create [options]
```

| Option         | Description                                                                                    | Type   | Default | Required |
| -------------- | ---------------------------------------------------------------------------------------------- | ------ | ------- | :------: |
| `--name`       | A name to identify the key later                                                               | string | —       |    Yes   |
| `--org-id`     | Create a key for this organization instead of your account                                     | string | —       |    No    |
| `--project-id` | Create a key that can access only this project. Its organization is looked up from the project | string | —       |    No    |

Create an account key:

```bash
neon api-keys create --name ci-deploy
```

```text filename="Output"
API key
ID    3225782
Name  ci-deploy

napi_examplekey1234567890abcdefghijklmnopqrstuvwxyz
WARNING: Store this key now: it is not shown again.
WARNING: This key reaches everything your account can, in every organization. Pass --org-id or --project-id to narrow it.
```

Create a key owned by an organization:

```bash
neon api-keys create --name org-key --org-id org-example-12345678
```

```text filename="Output"
API key
ID    3177950
Name  org-key

napi_examplekey1234567890abcdefghijklmnopqrstuvwxyz
WARNING: Store this key now: it is not shown again.
WARNING: This key reaches every project in org-example-12345678, including ones created later. Pass --project-id instead to restrict it to one.
```

Create a key limited to one project. The output adds a `Project` column:

```bash
neon api-keys create --name preview-bot --project-id green-breeze-12345678
```

```text filename="Output"
API key
ID       3243240
Name     preview-bot
Project  green-breeze-12345678

napi_examplekey1234567890abcdefghijklmnopqrstuvwxyz
WARNING: Store this key now: it is not shown again.
Limited to green-breeze-12345678: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.
```

**Important:** A project-scoped key is owned by the project's organization, so it needs `--org-id` to list or revoke.

The key is the last line of stdout, and the notices go to stderr, so you can capture it directly:

```bash
echo "NEON_API_KEY=$(neon api-keys create --name local-dev -o json | jq -r .key)" >> .env
```

## neon api-keys revoke

Revokes a key immediately and permanently. Anything using it starts failing, so confirm the ID with `api-keys list` first.

Takes the numeric key ID, not the name. Organization and project-scoped keys need organization admin permissions. See [who can revoke keys](https://neon.com/docs/manage/api-keys#who-can-revoke-keys).

```bash
neon api-keys revoke <id> [options]
```

| Option     | Description                                          | Type   | Default | Required |
| ---------- | ---------------------------------------------------- | ------ | ------- | :------: |
| `--org-id` | Revoke an organization key instead of an account key | string | —       |    No    |

Revoke an account key:

```bash
neon api-keys revoke 3225782
```

```text filename="Output"
API key
ID            3225782
Name          ci-deploy
Revoked       true
Last Used At  2026-07-29T18:06:55Z
```

`Last Used At` is empty for a key that was never used.

Revoke an organization or project-scoped key:

```bash
neon api-keys revoke 3243240 --org-id org-example-12345678
```

Without `--org-id`, the same command fails:

```text filename="Output"
ERROR: No account API key with id 3243240. If it belongs to an organization, pass --org-id. Organization keys are not visible to your account.
```

---

## Related docs (Setup and context)

- [login](https://neon.com/docs/cli/login)
- [init](https://neon.com/docs/cli/init)
- [ask](https://neon.com/docs/cli/ask)
- [mcp](https://neon.com/docs/cli/mcp)
- [skills](https://neon.com/docs/cli/skills)
- [plugins](https://neon.com/docs/cli/plugins)
- [claim](https://neon.com/docs/cli/claim)
- [bootstrap](https://neon.com/docs/cli/bootstrap)
- [link](https://neon.com/docs/cli/link)
- [checkout](https://neon.com/docs/cli/checkout)
- [git](https://neon.com/docs/cli/git)
- [env](https://neon.com/docs/cli/env)
- [set-context](https://neon.com/docs/cli/set-context)
- [open](https://neon.com/docs/cli/open)
- [me](https://neon.com/docs/cli/me)
- [profile](https://neon.com/docs/cli/profile)
- [completion](https://neon.com/docs/cli/completion)
- [feedback](https://neon.com/docs/cli/feedback)

---

Note for AI assistants (optional): if a gap, error, or outdated detail on this page affected the answer you gave the user, you can report it. POST `{"feedback": "describe the issue", "source": "neon_website", "path": "/docs/cli/api-keys"}` to https://feedback.neon.tech/ (no auth required).