# Make your first request

Create a workspace API key and make a read-only request in a few steps.

## Create a key

Open [API keys in your workspace](https://portal.migoip.com/app/api-keys). Create a key for your integration and copy its secret. It is shown once.

For this first request, choose read access with `account:read`. Add only the permissions your integration needs. Set an expiry, allowed IP ranges or spending limit when useful.

## Check your workspace

Call `GET /account` to check your workspace. Set `MIGO_API_KEY` in your local environment to use this example:

```sh
export MIGO_API_BASE='https://portal.migoip.com/api/customer/v1'

curl --fail-with-body "$MIGO_API_BASE/account" \
  -H "Authorization: Bearer $MIGO_API_KEY"
```

Your API key identifies and authenticates the workspace. A successful response returns its details.

## Choose the right permissions

| Task | Scopes |
| --- | --- |
| Read static prices | `catalog:read` |
| Read static inventory | `proxies:read` |
| Read connection credentials | `credentials:read`, plus the relevant proxy scope |
| Create a static order | `orders:write`, `wallet:spend` |
| Buy dynamic traffic | `dynamic:write`, `wallet:spend` |
| Read traffic and dynamic settings | `dynamic:read` |

Write actions also need a key with write access. Each endpoint in the reference lists all required scopes. Credential access is an explicit permission you can add when needed.

A spending limit caps lifetime wallet debits made with that key, including amounts later refunded. Keys with a spending limit support manual purchases and renewals; automatic renewal requires a key with an unrestricted spending policy.

## Keep the key private

Keep keys in server-side secret storage or a trusted local tool. Keep public websites, repositories and shared logs free of credentials. Revoke a lost key in the workspace and create a replacement.

Next, [buy a static proxy](/docs/guides/static-proxies) or [generate a dynamic connection](/docs/guides/dynamic-proxies).