# API keys and integrations

## API keys

Staff create personal API keys in Admin → Addons & integrations → **API keys**. A key is shown once, carries a subset of your own permissions (scopes) and can expire after 1 to 3650 days. Send it as `Authorization: Bearer pelty_…`.

- Keys work on the API routes their scopes allow, but never on `/auth/…`, `/account/…` or the API-key routes themselves: a key cannot create or revoke keys.
- Creating, listing and revoking keys needs an interactive sign-in.
- Failed key lookups are rate-limited per IP address. The last use time and IP are recorded.
- Staff can revoke all keys of a user.

## OAuth clients and SAML

**OAuth clients** registers apps that sign users in with PeltyCMS (PeltyCMS as OAuth provider). Clients see the apps they approved under **Connected apps**. **SAML** configures SAML identity providers for single sign-on.

## The HTTP API

Every route is listed in the developer [HTTP API](developers/api.md) reference with its permission, parameters and responses, and as an OpenAPI document (`developers/api.json`). The [Developer docs](developers/index.md) cover events, webhooks and writing addons.