# How to Manage Namespace Access Keys Functions are blocks of code that run on demand without the need to manage any infrastructure. Develop on your local machine, test your code from the command line (using `doctl`), then deploy to a production namespace or App Platform — no servers required. Namespace access keys provide user-specific authentication credentials for the Functions API. Each access key is unique to a user or application, allowing you to revoke access individually without affecting other users or workloads. Namespace access keys use HTTP basic authentication. The access key ID is the username and the secret key is the password. When creating a key, you must specify an expiration time or choose to create a key that never expires. ## Prerequisites To create or manage namespace access keys, you need the `function:admin` permission. To use `doctl` commands, you need [doctl installed and configured](https://docs.digitalocean.com/reference/doctl/how-to/install/index.html.md). ## Create Access Keys ## Control Panel To create a namespace access key, go to the [control panel](https://cloud.digitalocean.com/functions). In the left menu, click **Functions**, and then click the namespace you want to create a key for. In the namespace’s overview page, click its **Settings** tab. Under the **Namespace Access Keys** section, click **Create Access Key**, and then enter a name for your access key and select an expiration time (30 days, 60 days, 90 days, 1 year, or never). Afterwards, click **Create Access Key**. The access key ID and secret key appear. This is the only time the secret key is displayed. Copy it and store it in a secure place. ![The Access Keys section of the namespace settings page showing a newly created key with the secret key displayed](https://docs.digitalocean.com/screenshots/functions/create-access-key.05b0c6c4254a9a9e75ad6d0a55ad245365fa0b34070bc664525cb645330cb8f8.png) ## doctl By default, `doctl serverless key` commands operate on your currently connected namespace. To create a namespace access key, use the `--name` flag to specify a key name and the `--expiration` flag to set an expiration time. Expiration times must be at least 1 hour. You can specify durations in hours (`1h`, `12h`) or days (`7d`, `30d`), or use `never` for keys that don’t expire: ```shell doctl serverless key create --name ci-cd-key --expiration never ``` The output displays the secret key once: ```shell Notice: The secret key for "ci-cd-key" is shown below. Please save this secret. You will not be able to see it again. ID Name Secret dof_v1_a1b2c3d4e5f67890 ci-cd-key /1x2y3z4a5b6c7d8e9f0g1h2i3j4k5l6m7n8o9p ``` To create a key in a different namespace without switching your connection, use the `--namespace` flag: ```shell doctl serverless key create --name ci-cd-key --namespace fn-abc123 --expiration 30d ``` ## List Access Keys ## Control Panel To view all access keys for a namespace, go to the [control panel](https://cloud.digitalocean.com/functions). In the left menu, click **Functions**, and then click the namespace you want to view keys for. In the namespace’s overview page, click its **Settings** tab, and then you can see your keys under the **Namespace Access Keys** section. ![The Access Keys section showing multiple keys with their names, IDs, and expiration times](https://docs.digitalocean.com/screenshots/functions/list-access-keys.6a69bfa4380c2b89146f5a79f9cc2aada779262cb0073cc6e930c502df484861.png) ## doctl To list all access keys for your currently connected namespace: ```shell doctl serverless key list ``` The output includes a truncated ID, the key name, the hidden secret placeholder, and timestamps: ``` ID Name Secret Created At Expires At dof_v1_a1b2c3... my-laptop-key 2025-10-01 11:30:00 UTC N/A dof_v1_b9c8d7... ci-cd-key 2025-09-28 15:00:00 UTC 2026-09-28 15:00:00 UTC ``` To list keys in a different namespace without switching your connection, use the `--namespace` flag: ```shell doctl serverless key list --namespace fn-abc123 ``` ## Use Access Keys To connect `doctl` to a namespace using an access key, pass the namespace and the `--access-key` flag: ```shell doctl serverless connect fn-abc123 --access-key "dof_v1_a1b2c3d4e5f67890:/1x2y3z4a5b6c7d8e9f0g1h2i3j4k5l6m7n8o9p" ``` After you connect with `--access-key`, other `serverless` commands automatically use the stored credentials. To view your currently connected namespace: ```shell doctl serverless status ``` You can also use namespace access keys to make direct HTTP requests to the Functions API to invoke functions, retrieve activation records, and perform other operations. Use HTTP basic authentication with the access key ID as the username and the secret key as the password. For example, to invoke a function: ```shell curl -X POST "https:///api/v1/namespaces//actions//?blocking=true&result=true" \ -H "Content-Type: application/json" \ -u ":" ``` Replace `` and `` with your function’s API host and namespace, `` and `` with your package and function names, and `:` with your namespace access key credentials. ## Delete Access Keys Deleting an access key permanently revokes it and immediately prevents authentication with that credential. ## Control Panel To delete an access key, go to the [control panel](https://cloud.digitalocean.com/functions). In the left menu, click **Functions**, and then click the namespace containing the key you want to delete. In the namespace’s overview page, click the **Settings** tab. Under the **Namespace Access Keys** section, on the right of the key you want to revoke, click **…**, and then click **Revoke**. ## doctl To delete an access key: ```shell doctl serverless key delete dof_v1_a1b2c3d4e5f67890 ``` By default, the command prompts for confirmation. Press ‘y’ to confirm: ```shell Warning: Deleting this key is a permanent action. Are you sure you want to delete key dof_v1_a1b2c3d4e5f67890? (y/N) y Key dof_v1_a1b2c3d4e5f67890 has been deleted. ``` To skip the confirmation prompt, add the `--force` flag to the delete command. To delete a key in a different namespace without switching your connection, use the `--namespace` flag: ```shell doctl serverless key delete dof_v1_a1b2c3d4e5f67890 --namespace fn-abc123 ``` When you remove a team member from your DigitalOcean team, all namespace access keys associated with that user are automatically revoked across all namespaces. ## Migrate from Legacy Shared Credentials **Warning**: Legacy shared namespace credentials (the **Show Token** feature in the control panel) are deprecated. Migrate to namespace access keys. During a migration period, both legacy shared credentials and namespace access keys authenticate. After 3 June 2026, legacy credentials will no longer authenticate. To migrate from legacy shared credentials, [create a namespace access key](#create-access-keys) for each user or application that needs access, and then [update your `doctl` configurations, scripts, and CI/CD pipelines](https://docs.digitalocean.com/products/functions/reference/project-configuration/index.html.md) to use the new access keys.