API Key Manager

Upwork's roles table describes the role as allowing someone to "create and update API key on behalf of the organization". It lists three permissions: create an API key for the organization, update scopes for the key, and maintain key rotation. It is the narrowest role in the table, with nothing about reports, memberships or the roster.

Keys still belong to a person's account. Upwork's article on key ownership says a key is always assigned to the Upwork account of the person who submits the request, and that Upwork can't transfer ownership of it. If that person leaves the company, Upwork suggests requesting a new key and stopping use of the old one. It also suggests companies and agencies keep two keys: a development key to share with a developer, and a production key that is not shared.

Why it is separate from admin. The Account admin role can also establish APIs and integrations, but it can assign roles and change exclusive members' settings as well. Giving someone API Key Manager instead lets them run the integration without control of the team.

What the role does not change. A key still needs Upwork's approval; the eligibility rules and the request process are covered under Upwork API key. And a key does not permit automation outside its approved use: Upwork's guidance lists sharing keys across users without authorisation and using a key outside its scope among the reasons keyed accounts get flagged; see automation policy.

How Upsight uses it. Upsight's setup guide asks agencies to apply for their key from the agency context, so the key can see every member's proposals, and names Account Admin or API Key Manager as the agency roles that can do it. A workspace's key is used only for that workspace's own work, never to read or send for another workspace.