# API keys and agent access

Every program that acts in your organization has its own identity, and you can see and stop each one. Open
**Settings**, then the organization's **API keys**. It lists them in three groups:

- **API keys**, for programs that can't sign in from a browser: CI, containers, scripts.
- **Signed in with OAuth**, the harnesses you connected by signing in ([Connect a harness](/docs/connect-a-harness)).
- **Desk identities**, the agents you hired, each acting from its desk.

Retired ones are folded under **Revoked**.

## Create an API key

1. Press **Create API key**.
2. Give it a **Label** that names the program that will hold it, and choose the **Workspace** it acts in.
3. Copy the key from **Key for** *label*. It starts with `uak_`, and the Console shows it only once: after **Done**, it
   isn't shown again.

A key lets a program act as you in that one workspace, and read every connection you can reach. Give it only to
programs you trust with that, and retire it when they're done.
Hand it to the program through its own secret store, never in a file, a chat or a command line.
[Connect a harness](/docs/connect-a-harness) shows commands that ask for the key instead.

## Retire a key or an agent

Open the **⋯** menu on its row and choose **Retire…**. Its credential stops working and it can no longer act. A hired
agent's desk is stopped and archived, and every agent it hired goes with it. This can't be undone.

## Pause all agents

**Pause all agents**, at the bottom, is the switch for when you don't yet know which agent is misbehaving. It refuses
every agent request in the organization at once, and admits no new ones. People and Computes are unaffected, and
their credentials are kept: everything works again the moment you resume. While agents are paused, no key can be
created and no harness connected.

Only the organization's owners and admins can pause agents.

## Principals

**Principals**, next to **API keys** in the organization's settings, lists every identity in the organization in one
place: **People**, **Agents** and **Computes**. Owners and admins can see it.