> ## Documentation Index
> Fetch the complete documentation index at: https://docs.proxyscrape.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes and restrictions

> Limit API key access with subaccount scoping, IP restrictions, and expiration.

When you [create](/api/account/create) or [edit](/api/account/lifecycle) an API key, you can narrow its scope and add restrictions. These are available in both the dashboard and the API.

## Setting restrictions in the Dashboard

All three restrictions are configurable in the Create and Edit API Key modals.

### Subaccount access

The **Subaccount Access** dropdown lets you select which subaccounts the key can act on. Each subaccount is shown with its label and a color-coded chip indicating the product type (e.g. datacenter, residential). Leave the selection empty to allow access to all subaccounts.

<Frame>
  <img src="https://mintcdn.com/proxyscrape/0r4UOicey59Hm9IT/images/api-keys/subaccount-access.png?fit=max&auto=format&n=0r4UOicey59Hm9IT&q=85&s=a265442c91ab3b99f1cb3056a6a11245" alt="Subaccount access dropdown with product-type chips" width="1024" height="310" data-path="images/api-keys/subaccount-access.png" />
</Frame>

### IP restrictions

The **IP Restrictions** field lets you add one or more IPv4/IPv6 addresses or CIDR ranges (e.g. `192.168.1.0/24`). When set, only requests from these IPs can use the key.

<Frame>
  <img src="https://mintcdn.com/proxyscrape/0r4UOicey59Hm9IT/images/api-keys/ip-restrictions.png?fit=max&auto=format&n=0r4UOicey59Hm9IT&q=85&s=719ad65ec8c818121322ba87bf480337" alt="IP restrictions input with example IPs" width="1024" height="228" data-path="images/api-keys/ip-restrictions.png" />
</Frame>

<Warning>
  If you set IP restrictions, make sure your deployment IPs (or CIDR) are included, or requests from those IPs will fail with 403.
</Warning>

### Expiration

Toggle **Expiration** on to set a date and time after which the key automatically becomes invalid. Useful for temporary keys (e.g. short-lived automation or contractor access).

<Frame>
  <img src="https://mintcdn.com/proxyscrape/0r4UOicey59Hm9IT/images/api-keys/expiration.png?fit=max&auto=format&n=0r4UOicey59Hm9IT&q=85&s=8fa1d0f717863f6c12d60aa286e43a77" alt="Expiration toggle with date picker" width="1024" height="550" data-path="images/api-keys/expiration.png" />
</Frame>

## API field reference

When creating or updating keys via the API, these fields control scope and restrictions:

### allowed\_subaccounts

* **Type:** array of strings (subaccount IDs), or empty/omitted.
* **Meaning:** Limits which subaccounts the key can act on. Only relevant when the key is used in a context that has multiple subaccounts.
* **Empty or omitted:** The key can act on **all** subaccounts the creator can access.
* **Non-empty:** The key can act only on the listed subaccount IDs. Requests for other subaccounts will be denied (e.g. 403).

### allowed\_ips

* **Type:** array of strings. Each string is a single IPv4/IPv6 address or a CIDR block (e.g. `192.168.1.0/24`).
* **Meaning:** Restricts which client IPs can use this key. Requests from other IPs receive 403.
* **Omitted or empty:** No IP restriction; the key can be used from any IP.

### expires\_at

* **Type:** integer (Unix timestamp) or `null`. Optional; must be in the future. Omitted is treated as no expiry.
* **Meaning:** After this time, the key is invalid and requests using it receive 401.
* **`null` or omitted:** The key does not expire unless you revoke or regenerate it.

<Tip>
  Use `expires_at` for temporary keys (e.g. short-lived automation or contractors) to avoid having to remember to revoke them.
</Tip>