> ## Documentation Index
> Fetch the complete documentation index at: https://docs.papermap.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Projects and keys

> Choose the correct AIR credential and keep every integration scoped to one project.

Every AIR credential belongs to a project and has one purpose.

| Credential      | Used by          | Capability                                                     |
| --------------- | ---------------- | -------------------------------------------------------------- |
| App key         | Your application | Create, read, wait for, and cancel runs.                       |
| Worker key      | Your worker      | Register tools, claim tasks, renew leases, and return results. |
| Console session | Human users      | Configure projects through the AIR console.                    |

<Frame caption="Issue app and worker credentials independently from project settings.">
  <img src="https://mintcdn.com/papermap/6FYSF5TTvsKzeVI6/air/images/project-keys.png?fit=max&auto=format&n=6FYSF5TTvsKzeVI6&q=85&s=3ad49dcce41c9d8e1ba75fbda5fa6d85" alt="AIR project settings showing separate app and worker key controls" width="2880" height="1800" data-path="air/images/project-keys.png" />
</Frame>

## Issue a key

<Steps>
  <Step title="Open Settings">
    Select the project, then open **Settings**.
  </Step>

  <Step title="Choose the key scope">
    Select **Issue app key** for application code or **Issue worker key** for an
    outbound worker.
  </Step>

  <Step title="Store the value immediately">
    AIR shows the complete key once. Put it in a local environment variable for
    development or a managed secret store for deployment.
  </Step>
</Steps>

<Warning>
  Never commit a key. Avoid passing worker keys with `air worker start --key`
  in shared environments because command arguments can appear in shell history
  and process listings. Prefer `AIR_WORKER_KEY`.
</Warning>

## Roles are not cloud roles

* **Owner** manages project configuration, members, credentials, and tool approval.
* **Editor** changes agents and prompts.
* **Viewer** reads project state and traces.
* **Platform admin** is an AIR application role with cross-project access. It is
  not an Azure role.