Agency API keys
Agency API Keys is its own page, listing every API key across every client workspace in an Agency Group at once. It's the same underlying key system as the per-workspace API keys tab under Settings — just viewed and managed across an entire agency from one screen, instead of one workspace at a time.
The agency key list
Every key from every client workspace in the group appears in one table, each row tagged with a colored Client badge so keys from different workspaces stay visually distinct at a glance. If the account belongs to more than one Agency Group, a group switcher appears to move between them.
Each client's badge color is derived deterministically from its workspace ID, so a given client's badge never shifts just because the key list re-sorted or another client's key was created or revoked around it. Create key is disabled — with a tooltip explaining why — if this agency has no client workspaces at all.
Creating a key for a client
The create form is the same label + scopes form as the per-workspace API keys tab, with one addition: a Client picker at the top, choosing which of the agency's workspaces the new key belongs to.
Client
Key label
Scopes — this key can only do what you grant here
The same six resources and twelve Read/Write scope values apply — see The six scoped resources. The freshly generated key is shown exactly once, in the same amber-highlighted, copy-now reveal box used everywhere else in ForgeSend a key is generated.
A key created here is scoped to exactly one client workspace — the one you pick — for its whole life. There's no such thing as a single key that works across multiple clients. Everything about how the key behaves once created — its scopes, its revocation, its one-time reveal — is identical to a key created from that client's own Settings → API tab; this page only changes where you view and manage it from.
With no keys yet across the whole agency, the table is replaced with "No API keys across this agency yet."
Revoking a key
Clicking Revoke on any row — regardless of which client it belongs to — shows the same inline "Sure?" confirmation with Yes/No the per-workspace Active keys table uses, no modal. Revocation is immediate and permanent, exactly as it is from a client's own Settings.
Where to go next
Next: Agency Groups overview