> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# dome platform-keys

> Manage platform API keys for users and CI

Platform API keys provide programmatic access for users and CI pipelines. For agent authentication keys, use `dome agents create-key`.

| Command                     |                                          |
| --------------------------- | ---------------------------------------- |
| [List](#list)               | `dome platform-keys list`                |
| [Create](#create)           | `dome platform-keys create`              |
| [Revoke](#revoke)           | `dome platform-keys revoke [name-or-id]` |
| [Permissions](#permissions) | `dome platform-keys permissions`         |

***

## List

`dome platform-keys list`

List platform API keys for the current workspace.

## Create

`dome platform-keys create`

Create a new platform API key.

| Flag            | Type      | Required    | Description                                                                                                      |
| --------------- | --------- | ----------- | ---------------------------------------------------------------------------------------------------------------- |
| `--name`        | string    | Yes         | Key name                                                                                                         |
| `--permissions` | string\[] | Conditional | Permissions to grant. Required in non-interactive mode; in an interactive terminal a picker is shown if omitted. |
| `--expires-at`  | string    | No          | Expiration time (RFC3339)                                                                                        |

The interactive picker fetches the grantable permissions for your role at the current scope. Use [`dome platform-keys permissions`](#permissions) to discover the same list non-interactively.

## Revoke

`dome platform-keys revoke [name-or-id]`

Revoke a platform API key by name or ID.

## Permissions

`dome platform-keys permissions`

List the permissions you can grant to a new platform API key at the current context's scope. The output is exactly what `dome platform-keys create --permissions` will accept for your role; the server re-validates on submit.

Use this for CI scripts that need to know valid `--permissions` values, or to confirm what `create` would offer in its interactive picker.

The scope follows your active context: a workspace context returns workspace permissions, a tenant context adds tenant permissions, and an org context adds org permissions on top.

```bash theme={"system"}
dome platform-keys permissions
```

```bash theme={"system"}
dome platform-keys permissions --format json
```

<Note>
  Workspace admins do not see tenant-only permissions such as `agent.delete` or `agentkey.manage` in this list. Switch to a tenant or org context (or have a tenant admin run the command) to grant them.
</Note>