> ## Documentation Index
> Fetch the complete documentation index at: https://docs.skinloop.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and scopes

> Create, scope, rotate, and revoke merchant keys.

Create keys for checkout creation, reporting, and operational jobs. Each single
key record can allow `cs2`, `rust`, or both; a checkout's `allowedGames` must be
a subset of that key's game access. Do not create separate CS2 and Rust key
records just to represent game access. The dashboard is
the source for issuing, viewing metadata for, rotating, and revoking keys.

| Scope             | Allows                                    |
| ----------------- | ----------------------------------------- |
| `checkout:create` | Create hosted checkout sessions           |
| `checkout:read`   | Read a merchant checkout and its status   |
| `payments:read`   | Read payment data exposed to the merchant |
| `payouts:read`    | Read payout data exposed to the merchant  |

Keys are not silently elevated. Issue a new key when adding access, update the
server secret, deploy the change, and revoke the old key only after traffic has
moved. If a key is exposed, revoke it first and investigate requests made with
it. Never send a key from a browser or mobile client.

<Warning>
  Scopes and game access are authorization controls, not a replacement for
  server-side order validation. Treat every API response as untrusted input and
  fulfill only from a confirmed `completed` result.
</Warning>

**Next:** use the [Quickstart](/quickstart) with a test key.