> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getmillwork.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a provider machine key

> Choose limited provider permissions and an expiry, save the one-time secret, and revoke it when no longer needed.

**Goal:** Give a tool limited access to your organization's Provider workspace,
the dashboard area for its application and model routes.

**You are done when:** you have stored the secret securely and checked its
permissions and expiry. Creating a key does not submit a feed or approve a
route.

## Check your invitation first

Machine access is **by invitation** and must be enabled separately for your
organization. These instructions describe the key controls; they do not mean
machine access has been enabled for your organization. If **Machine access is
not enabled for this organization** appears, continue in the browser and
contact Millwork about an invitation. Existing keys can still be reviewed and
revoked while access is off.

An owner or admin must create and manage these keys in their browser session.
A normal organization API key cannot replace a provider machine key.

**1. Open Machine keys**

In [Provider workspace](https://app.getmillwork.dev/provider/keys), open
**Machine keys** and refresh the list. Choose **Create machine key** when
machine access is enabled.

**2. Choose permissions and expiry**

Add a useful label. Select only the permissions the tool needs:

| Permission | What it allows |
| - | - |
| `provider:read` | Read provider state and validation context, and check a feed online without staging it. |
| `provider:feed` | Stage a feed and deprecate a route. |

Choose **1 day**, **7 days**, or **30 days**. Expiry is required; a key cannot
renew itself. These permissions do not allow customer runs, domain proof,
profile changes, webhook setup, or creating another key. Withdrawal and other
protected changes need their own browser approval.

**3. Save the secret once**

Choose **Create key**, then store the secret in your approved secret store
before closing the reveal. The key ID and prefix identify the key; they are
not the secret. The secret cannot be retrieved later.

For invited online CLI access, configure `MILLWORK_PROVIDER_API_KEY` privately
and `MILLWORK_PROVIDER_API_URL` with the API origin including `/v1`. Do not put
the secret in command arguments, feed files, source code, chat or logs. A
shell-capable agent can read its own environment, so use only the bounded key
you intend that tool to hold.

## Recover an uncertain creation

If the first response or secret is lost, **do not repeat the creation request**.
Refresh the list, identify any new key by its label, ID and prefix,
and revoke every new key whose secret you did not save. Then explicitly create
a replacement. A repeated successful request can return
`idempotent_replay_secret_unavailable`; it cannot recover the old secret.

## Revoke or replace a key

Open **Machine keys**, choose **Revoke** for that key, check its identity and
confirm. Revocation takes effect on its next request and cannot be undone.
When replacing a key, update the tool's secret store and revoke the old key.
An expired or revoked key must be replaced; enabling machine access again does
not renew it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.