> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Access Keys

Access keys authenticate API requests with a signed request header. They are
available from **Profile > Access Keys** and are scoped to your current user and
permissions.

![Access key list](/images/v5/jumpserver/profile_03_access_key.png)

## Create an access key

1. Open **Profile > Access Keys**.
2. Select **Create**.
3. Optionally restrict the key with an IP allowlist.
4. Save the key and copy the **Secret** immediately.

The list shows the secret (only at creation), IP allowlist, active state, creation
time, and last-used time. A user can create up to 10 access keys.

## Use an access key

Use the access key and secret to sign API requests. The API reference is available
at `/api/docs/` on the JumpServer host. The key inherits the permissions of the
current user; it cannot grant more access than the user already has.

## Token format validation

Changed in v5.1.1
When a request authenticates with a Bearer Token, JumpServer validates the token
format and rejects tokens whose format is invalid. Format validation preserves fallback
compatibility with other Bearer Token authentication methods, so existing API
clients that authenticate with those methods keep working.

## Security notes

- The secret is shown only once. Store it in a password manager or secret store.
- Never put a secret in documentation, screenshots, or source control.
- Revoke a key immediately if it is exposed or no longer needed.
- Access keys are not the same as connection tokens used by native clients.

Related: [Tokens](https://www.jumpserver.com/docs/features/general/account/tokens.md) and
[Developer Guide > REST API](https://www.jumpserver.com/docs/developer-guide/rest-api.md).

## Version history

| Version | Change                                                                                                          |
| ------- | --------------------------------------------------------------------------------------------------------------- |
| v5.1.1  | Added Access Token format validation with fallback compatibility for other Bearer Token authentication methods. |