> For the complete documentation index, see [llms.txt](https://firstoken.gitbook.io/api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://firstoken.gitbook.io/api-docs/how-to/create-an-api-key-or-external-app.md).

# Create an API Key or External App

Firstoken provides two credential types for programmatic access: **API Keys** and **External Apps**. Both require IP whitelisting at the time of creation.

***

### API Key

API Keys authenticate requests to Firstoken APIs.

#### Steps

1. Log in to the Firstoken Console.
2. Navigate to **Keys**.
3. Click **Add API Key**.
4. Complete the following fields:

| Field        | Required | Description                                                         |
| ------------ | -------- | ------------------------------------------------------------------- |
| Name         | Yes      | Identifies the API Key.                                             |
| Description  | No       | Optional context.                                                   |
| Permissions  | Yes      | Select one or more permissions.                                     |
| IP Whitelist | Yes      | Add one or more allowed IPs. To allow all traffic, use `0.0.0.0/0`. |

To add an IP, click **Add IP**, enter the address and an optional description, then confirm.

5. Click **Create**. A modal displays the **API Key ID**.

> **Important:** The API Key ID is shown only once at creation. Store it immediately in a secure location. It cannot be retrieved again after closing this modal.

#### Available permissions

| Permission          | Description                               |
| ------------------- | ----------------------------------------- |
| Tokenize card(s)    | Tokenize one or more cards.               |
| Detokenize token(s) | Detokenize one or more tokens.            |
| Inspect a Token     | View the full PAN associated to a token.  |
| Delete token(s)     | Delete one or more tokens from the vault. |
| Create Transaction  | Create a transaction.                     |
| Get Transaction     | Retrieve transaction information.         |
| Inspect Transaction | Inspect transaction details.              |
| Delete Transaction  | Delete a transaction.                     |
| Proxy Request       | Send a request through the Proxy.         |
| Payment Request     | Send a payment request.                   |

***

### External App

External Apps support two key types: **Signing Key** and **Authorization Key**.

#### Steps

1. Log in to the Firstoken Console.
2. Navigate to **External Apps**.
3. Click **Add External App**.
4. Complete the following fields:

| Field        | Required | Description                                                         |
| ------------ | -------- | ------------------------------------------------------------------- |
| Name         | Yes      | Identifies the External App.                                        |
| Description  | No       | Optional context.                                                   |
| Key type     | Yes      | Select **Signing Key** or **Authorization Key**.                    |
| Permissions  | Yes      | Select one or more permissions.                                     |
| IP Whitelist | Yes      | Add one or more allowed IPs. To allow all traffic, use `0.0.0.0/0`. |

To add an IP, click **Add IP**, enter the address and an optional description, then confirm.

5. Click **Create**. A modal displays the credentials for the selected key type.

#### Available permissions

| Permission                    | Description                           |
| ----------------------------- | ------------------------------------- |
| Render a Form                 | Render a Firstoken-hosted form.       |
| Create a Transaction Request  | Create a transaction request.         |
| Monitor a Page                | Monitor a page for CSP events.        |
| Allow Inbound Routes requests | Send requests through Inbound Routes. |

#### Credential reference

| Key type          | Credentials shown at creation | Retrievable later                                            |
| ----------------- | ----------------------------- | ------------------------------------------------------------ |
| Signing Key       | Key ID                        | Yes — visible when editing the External App.                 |
| Authorization Key | Key ID and Key Secret         | Yes — both values are visible when editing the External App. |