# Keys and scopes

> How a Build key authenticates, what it can reach, and how to revoke or rotate it.

## Key types

| Key | Looks like | Reaches |
|---|---|---|
| Live, read | `sm_live_…` | The accounts you chose, read only |
| Live, read and write | `sm_live_…` | The same accounts. Can also change Amazon accounts, behind guardrails |
| Sandbox | `sm_test_…` | Demo data, read only |

## Scopes

Each key is scoped per key and per account. A key is either read, or read and write. A read key can never change anything. Writes exist on Amazon only; every other platform is read-only.

_To write: the full scope list as the API names it, and which tools each scope allows_

## Send the key

Send the key in the `X-API-Key` header on every call.

**curl**

```bash
curl -X POST https://build-api.sellermate.ai/v1/tools/get_inventory \
  -H "X-API-Key: $BUILD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"account":"acct_123"}'
```

## Revoke a key

You can revoke a key in one click in the console, without touching the rest. Give each tool or client its own key so one revoke affects one thing.

## Rotate a key

_To write: how to rotate: create the new key, switch the tool, revoke the old one. Say whether the console has a rotate action_

## Keep a key safe

- Store it as `BUILD_API_KEY` in your tool's secrets. Never put it in page code or in a prompt.
- Use the sandbox key while you build.
- Choose read unless the tool must change an Amazon account.