---
title: Service keys
description: Authenticate server-to-server management requests with organization-scoped permissions.
---

Service keys start with `zrv_svc_`. Keep them on trusted servers and send them as a Bearer token to supported `/product-users/by-external-id` routes at `https://api.zorveus.com`.

```http
Authorization: Bearer zrv_svc_your_service_key
```

Create, list, and revoke service keys in the dashboard. The raw value is shown only at creation.

## Supported service-key surfaces

| Scope | Routes |
| --- | --- |
| `product_users:read` | Profile, credit summary, allowance debt, and grant-list reads under `/product-users/by-external-id`. |
| `product_users:write` | `PUT /product-users/by-external-id` and `POST /product-users/by-external-id/credit-grants`. |

## Dashboard-only management

Create and manage apps, app connections, API keys, spending caps, provider credentials, and webhook settings in the dashboard. These operations are not part of the supported service-key API.

Change product-user status and revoke credit grants in the dashboard. Use an API key (`zrv_...`) for inference. Service keys cannot make inference requests.