> ## Documentation Index
> Fetch the complete documentation index at: https://learn.biq.li/llms.txt
> Use this file to discover all available pages before exploring further.

# Understand API key permissions

> Choose the resource access granted to a workspace API key.

Choose **All**, **Read Only**, or **Restricted** when creating a key. Restricted keys let you select None, Read, or Write for Links, QR codes, Biolinks, Link groups, Tracking pixels, Custom domains, and Tags.

Read grants the resource's view ability. Write includes the read, create, update, and delete abilities for that resource. A write that references another resource also needs read access to that related resource. For example, creating a link with a tag needs Links Write and Tags Read.

API keys are already workspace scoped, so there is no separate Workspaces permission. Link Read also returns the link's available click, lead, sale, revenue, and last-click summary fields.

## Permission presets

* **All** grants read and write access to every resource currently exposed by
  the Workspace API.
* **Read Only** grants view access without create, update, attach, detach, or
  delete operations.
* **Restricted** lets you choose None, Read, or Write for each resource.

## Write abilities

Write maps to the resource's create, update, and delete abilities, plus read.
Links use `links.create`, `links.update`, and `links.delete`, for example. Other
resources follow their documented QR code, Biolink, link group, tracking pixel,
custom domain, and tag abilities.

## Cross-resource example

Creating a link with `domain_id`, `folder_ids`, `tag_ids`, or `pixel_ids`
requires Links Write and read access to each referenced resource category. A
permission failure can therefore describe the related resource rather than the
link itself.

Create a new key when an integration needs materially different access instead
of broadening a shared key used by several systems.