diff --git a/HACKING b/HACKING
index a825f544..cbf0bb04 100644
--- a/HACKING
+++ b/HACKING
@@ -149,6 +149,8 @@ Here's a tree of the folders in this repo with descriptions of what each is for
 │   │   │        other types in lib.
 │   │   │        DefaultFieldsHaver interface defined and tested-for here
 │   │   │        (required for table & list output types)
+│   │   ├── morestrings - extra string manipulation functions used by multiple
+│   │   │                 packages
 │   │   └── prettyprint - PrettyPrinter interface and a helper function for
 │   │                     writing PrettyPrinters
 │   │                     All the types in lib/billing, lib/brain and lib/spp
@@ -240,4 +242,4 @@ To generate the hash, use the following command.
 
   find . -type d \! -path './.*' \! -path './vendor/*' | sort | shasum -a 256
 
-# sha256sum: 993688b7f02276dcbd79d543b41f9994be2776ca163c8c40b6cc346435f834ce
+# sha256sum: 14ec7f63021ea2d5f870bb638e911e540294fee5247a4e90f0b4020baf70071a
diff --git a/cmd/bytemark/commands/add/api_key.go b/cmd/bytemark/commands/add/api_key.go
new file mode 100644
index 00000000..8050fdd7
--- /dev/null
+++ b/cmd/bytemark/commands/add/api_key.go
@@ -0,0 +1,298 @@
+package add
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/args"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/flags"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/with"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/output/morestrings"
+	"github.com/BytemarkHosting/bytemark-client/lib/output/prettyprint"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/urfave/cli"
+)
+
+func init() {
+	Commands = append(Commands, cli.Command{
+		Name:    "api key",
+		Aliases: []string{"apikey"},
+		Flags: []cli.Flag{
+			cli.StringFlag{
+				Name:  "expires-at",
+				Usage: "Date the API key should expire. Leave unset for keys that never expire",
+			},
+			cli.GenericFlag{
+				Name:  "account-admin",
+				Usage: "Account to grant the API key administrative privilege over",
+				Value: &flags.AccountNameSliceFlag{},
+			},
+			cli.GenericFlag{
+				Name:  "group",
+				Usage: "Group to grant the API key administrative privilege over",
+				Value: &flags.GroupNameSliceFlag{},
+			},
+			cli.StringFlag{
+				Name:  "label",
+				Usage: "user-friendly label for the API key",
+			},
+			cli.GenericFlag{
+				Name:  "server",
+				Usage: "Server to grant the API key administrative privilege over",
+				Value: &flags.VirtualMachineNameSliceFlag{},
+			},
+			cli.StringFlag{
+				Name:  "user",
+				Usage: "User the API key will be attached to. Defaults to the user you log in as",
+			},
+		},
+		Usage:     "add an API key to your Bytemark Cloud Servers user",
+		UsageText: "add api key [--server <cloud server>]... [--group <group name>]... [--account-admin <account name>]... [--user <user>] <label>",
+		Description: `--expires-at may be set to any date format the Brain
+accepts, but we generally recommend ISO8601 format.
+
+--label or <label> is just for your reference to make it easier to discern keys
+from each other at a glance, without having to compare lists of privileges.
+
+Servers and groups will be searched for on the default account for the user
+you are logged in as - not the user specified in --user. This may trip up
+cluster administrators - use impersonation if you're not granting account_admin
+access.
+
+Only cluster administrators can create API keys with account-admin support. Pop
+and email over in to Bytemark support and we'll do it for you.
+
+Multiple --account-admin, --group and --server flags (and combinations thereof)
+can be supplied, and the API key will have privileges over each that is
+supplied.
+
+Note that the API key will only be able to access the Bytemark Cloud Servers API
+- to manage your cloud servers, IPs, discs and backups, not billing or domains.
+
+In future we may implement API key support on more of our API, but the 
+privileges to access those parts of the API will not be added automatically to
+any existing API keys. In other words - an API key with account admin access now
+will not be able to suddenly access your invoices/account owner address in
+future if and when we add that feature to API keys.
+
+EXAMPLES
+
+To create an API key for yourself without any privileges:
+
+  bytemark add api key currently-useless-api-key
+
+You can always add privileges later to make it a non-useless API key with the
+'grant' command using the --api-key flag. See 'bytemark help grant' for more
+details.
+
+To create an API key for yourself which can create, delete, and alter any server
+in the 'kube' and 'swarm' groups on your default account:
+
+  bytemark add api key --group kube --group swarm container-swarms-key
+
+To create a key for yourself with access to rescale the database servers in the
+'internal' group on an account 'big-data-services' which is not your default
+account:
+
+  bytemark add api key --server db1.internal.big-data-services \
+                       --server db2.internal.big-data-services \
+					   --label auto-rescale-db
+`,
+		Action: app.Action(args.Optional("label"), with.User("user"), func(ctx *app.Context) error {
+			keySpec, err := makeAPIKeySpec(ctx)
+			if err != nil {
+				ctx.LogErr("Couldn't make a specification for the API key")
+				return err
+			}
+
+			privsToCreate := keySpec.Privileges
+			keySpec.Privileges = nil
+
+			apiKey, err := brainRequests.CreateAPIKey(ctx.Client(), "", keySpec)
+			if err != nil {
+				return err
+			}
+			keySpec.APIKey = apiKey.APIKey
+			keySpec.ID = apiKey.ID
+
+			for i := range privsToCreate {
+				privsToCreate[i].APIKeyID = apiKey.ID
+			}
+
+			if len(privsToCreate) == 0 {
+				ctx.LogErr("Successfully created an api key:")
+				err = apiKey.PrettyPrint(ctx.Writer(), prettyprint.Full)
+				return err
+			}
+
+			ctx.LogErr("Successfully created api key, now creating %d privileges...", len(privsToCreate))
+			keySpec.Privileges = privsToCreate
+
+			// keep this error separate cause we check it later
+			privsErr := addAPIKeyPrivileges(ctx, keySpec)
+
+			done := "done."
+			if privsErr != nil {
+				done = "done, with some errors. Here's the API key we created with all the privileges we managed to create:"
+			}
+
+			ctx.LogErr(done)
+			err = apiKey.PrettyPrint(ctx.Writer(), prettyprint.Full)
+			if err != nil {
+				return err
+			}
+
+			return privsErr
+		}),
+	})
+}
+
+func makeAPIKeySpec(ctx *app.Context) (spec brain.APIKey, err error) {
+	spec.Label = ctx.String("label")
+	spec.UserID = ctx.User.ID
+	spec.ExpiresAt = ctx.String("expires-at")
+
+	if spec.Label == "" {
+		return spec, errors.New("a label must be specified for the key")
+	}
+
+	typesWithErrs := []string{}
+	spec.Privileges, err = addAPIKeySpecifyServerPrivileges(ctx, spec.Privileges)
+	if err != nil {
+		typesWithErrs = append(typesWithErrs, "servers")
+	}
+	spec.Privileges, err = addAPIKeySpecifyGroupPrivileges(ctx, spec.Privileges)
+	if err != nil {
+		typesWithErrs = append(typesWithErrs, "groups")
+	}
+	spec.Privileges, err = addAPIKeySpecifyAccountPrivileges(ctx, spec.Privileges)
+	if err != nil {
+		typesWithErrs = append(typesWithErrs, "accounts")
+	}
+	if len(typesWithErrs) > 0 {
+		err = fmt.Errorf("Some %s could not be looked up", morestrings.JoinWithSpecialLast(", ", " and ", typesWithErrs))
+	}
+
+	return
+}
+
+// creates a privilege spec for every --server flag
+func addAPIKeySpecifyServerPrivileges(ctx *app.Context, privileges brain.Privileges) (brain.Privileges, error) {
+	var serverErr error
+	for _, serverFlag := range flags.VirtualMachineNameSlice(ctx, "server") {
+		serverName := serverFlag.VirtualMachineName
+		ctx.LogErr("Looking up %s", serverName)
+
+		server, err := ctx.Client().GetVirtualMachine(serverName)
+		if err != nil {
+			ctx.LogErr(err.Error())
+			if serverErr == nil {
+				serverErr = errors.New("Some servers could not be looked up - see above for errors")
+			}
+			continue
+		}
+
+		privileges = append(privileges, brain.Privilege{
+			Level:            brain.VMAdminPrivilege,
+			Username:         ctx.User.Username,
+			VirtualMachineID: server.ID,
+		})
+	}
+	return privileges, serverErr
+}
+
+// creates a privilege spec for every --group flag
+func addAPIKeySpecifyGroupPrivileges(ctx *app.Context, privileges brain.Privileges) (brain.Privileges, error) {
+	var groupErr error
+	for _, groupFlag := range flags.GroupNameSlice(ctx, "group") {
+		groupName := groupFlag.GroupName
+		ctx.LogErr("Looking up %s", groupName)
+
+		group, err := ctx.Client().GetGroup(groupName)
+		if err != nil {
+			ctx.LogErr(err.Error())
+			if groupErr == nil {
+				groupErr = errors.New("Some groups could not be looked up - see above for errors")
+			}
+			continue
+		}
+
+		privileges = append(privileges, brain.Privilege{
+			Username: ctx.User.Username,
+			Level:    brain.GroupAdminPrivilege,
+			GroupID:  group.ID,
+		})
+	}
+	return privileges, groupErr
+}
+
+// creates a privilege spec for every --account-admin flag
+func addAPIKeySpecifyAccountPrivileges(ctx *app.Context, privileges brain.Privileges) (brain.Privileges, error) {
+	var accountErr error
+	for _, accountFlag := range flags.AccountNameSlice(ctx, "account-admin") {
+		accountName := accountFlag.AccountName
+		ctx.LogErr("Looking up %s", accountName)
+
+		account, err := ctx.Client().GetAccount(accountName)
+		if err != nil {
+			ctx.LogErr(err.Error())
+			if accountErr == nil {
+				accountErr = errors.New("Some accounts could not be looked up - see above for errors")
+			}
+			continue
+		}
+
+		privileges = append(privileges, brain.Privilege{
+			Username:  ctx.User.Username,
+			Level:     brain.AccountAdminPrivilege,
+			AccountID: account.BrainID,
+		})
+	}
+	return privileges, accountErr
+}
+
+// addAPIKeyPrivileges goes over the privilege specs and grants them to the api
+// key.
+func addAPIKeyPrivileges(ctx *app.Context, apiKey brain.APIKey) error {
+	// collect up all the errors to output a nice list at the end, so
+	// that we still output the complete API key as it actually stands
+	succeededPrivs := make(brain.Privileges, 0, len(apiKey.Privileges))
+	privErrs := []addAPIKeyPrivErr{}
+
+	for i, priv := range apiKey.Privileges {
+		priv.APIKeyID = apiKey.ID
+
+		err := ctx.Client().GrantPrivilege(priv)
+		if err != nil {
+			privErrs = append(privErrs, addAPIKeyPrivErr{
+				idx:  i,
+				priv: priv,
+				err:  err,
+			})
+		} else {
+			succeededPrivs = append(succeededPrivs, priv)
+		}
+	}
+	apiKey.Privileges = succeededPrivs
+
+	if len(privErrs) > 0 {
+		// catalogue the failures
+		lines := make([]string, len(privErrs))
+		for i, privErr := range privErrs {
+			lines[i] = fmt.Sprintf("  • %s: %s", privErr.priv, privErr.err)
+		}
+		intro := fmt.Sprintf("Couldn't create %d/%d privileges requested:", len(privErrs), len(apiKey.Privileges))
+
+		return errors.New(intro + "\n" + strings.Join(lines, "\n"))
+	}
+	return nil
+}
+
+type addAPIKeyPrivErr struct {
+	idx  int
+	priv brain.Privilege
+	err  error
+}
diff --git a/cmd/bytemark/commands/add/api_key_test.go b/cmd/bytemark/commands/add/api_key_test.go
new file mode 100644
index 00000000..68155e4e
--- /dev/null
+++ b/cmd/bytemark/commands/add/api_key_test.go
@@ -0,0 +1,323 @@
+package add_test
+
+import (
+	"errors"
+	"regexp"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/commands/add"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/mocks"
+	"github.com/urfave/cli"
+)
+
+type apiKeyWithErr struct {
+	brain.APIKey
+	err bool
+}
+type accountWithErr struct {
+	lib.Account
+	err bool
+}
+type serverWithErr struct {
+	brain.VirtualMachine
+	err bool
+}
+type groupWithErr struct {
+	brain.Group
+	err bool
+}
+type privWithErr struct {
+	brain.Privilege
+	err bool
+}
+
+func TestAddApiKey(t *testing.T) {
+	// here's all the test data for all the servers, groups and accounts we'll
+	// use in this test
+	serverNames := []lib.VirtualMachineName{
+		{VirtualMachine: "myserver", Group: "default", Account: "default-account"},
+		{VirtualMachine: "myserver2", Group: "test-group", Account: "test-account"},
+	}
+	servers := []brain.VirtualMachine{
+		{ID: 1},
+		{ID: 2},
+	}
+	groupNames := []lib.GroupName{
+		{Group: "", Account: "default-account"},
+		{Group: "test-group", Account: "test-account"},
+	}
+	groups := []brain.Group{
+		{ID: 11},
+		{ID: 12},
+	}
+	accountNames := []string{
+		"default-account",
+		"test-account",
+	}
+	accounts := []lib.Account{
+		{BrainID: 21},
+		{BrainID: 22},
+	}
+
+	// ok let's define some tests. basing it on testutil.CommandT to TRY to DRY
+	tests := []struct {
+		// CommandT provides all the basics to set up a config, client and app,
+		// all the basic mocks on config, all the stuff to get fake
+		// authentication going, and will run the app and assert a bunch of stuff too
+		testutil.CommandT
+
+		// aaand here's all the stuff to assert on and return from Request
+		// the map keys are used for the mock BuildRequest calls' URLs
+		accounts   map[string]accountWithErr
+		groups     map[lib.GroupName]groupWithErr
+		servers    map[lib.VirtualMachineName]serverWithErr
+		privileges []privWithErr
+		// apiKey is both the apiKey to return and some of its fields will be
+		// used to define the mock
+		apiKey apiKeyWithErr
+		user   brain.User
+	}{{
+		CommandT: testutil.CommandT{
+			Name:      "all defaults no label",
+			Args:      "",
+			ShouldErr: true,
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("Couldn't make a specification for the API key"),
+			},
+		},
+		user: brain.User{
+			ID: 299,
+			// username not specified in the input - test-user is the default
+			// returned by config.GetUser() (see testutil.BaseTestAuthSetup)
+			Username: "test-user",
+		},
+		apiKey: apiKeyWithErr{},
+	}, {
+		CommandT: testutil.CommandT{
+			Name: "all defaults",
+			Args: "test-api-key",
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("Successfully created an api key:\ntest-api-key\n  Expires: never\n  Key: apikey.apikey.ay1pee2eye3key\n"),
+			},
+		},
+		user: brain.User{
+			ID: 299,
+			// username not specified in the input - test-user is the default
+			// returned by config.GetUser() (see testutil.BaseTestAuthSetup)
+			Username: "test-user",
+		},
+		apiKey: apiKeyWithErr{APIKey: brain.APIKey{
+			ID:        1,
+			UserID:    299,
+			APIKey:    "apikey.ay1pee2eye3key",
+			Label:     "test-api-key",
+			ExpiresAt: "",
+		}},
+	}, {
+		CommandT: testutil.CommandT{
+			Name: "no privilege specs & POST fails",
+			Args: "test-api-key",
+			// output is expected to be blank at this stage since it's
+			// ProcessError which outputs the error message - which is called
+			// from main.main, not from the command's action.
+			ShouldErr: true,
+		},
+		user: brain.User{
+			ID:       299,
+			Username: "test-user",
+		},
+		apiKey: apiKeyWithErr{
+			APIKey: brain.APIKey{
+				Label: "bad-key",
+			},
+			err: true,
+		},
+	}, {
+		CommandT: testutil.CommandT{
+			Name:      "one server spec",
+			Args:      "--server myserver test-api-key",
+			ShouldErr: false,
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("creating 1 privilege"),
+			},
+		},
+		user: brain.User{
+			ID:       299,
+			Username: "test-user",
+		},
+		apiKey: apiKeyWithErr{
+			APIKey: brain.APIKey{
+				ID:    9201,
+				Label: "test-api-key",
+			},
+		},
+		privileges: []privWithErr{{
+			Privilege: brain.Privilege{
+				ID:               9292,
+				Username:         "test-user",
+				Level:            "vm_admin",
+				VirtualMachineID: 1,
+			},
+		}},
+		servers: map[lib.VirtualMachineName]serverWithErr{
+			serverNames[0]: serverWithErr{VirtualMachine: servers[0]},
+		},
+	}, {
+		CommandT: testutil.CommandT{
+			Name: "two of each type of privilege target",
+			Args: "--server myserver --server myserver2.test-group.test-account --group . --group test-group.test-account --account-admin default-account --account-admin test-account test-api-key",
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile(`creating 6 privileges`),
+			},
+		},
+		user: brain.User{
+			ID:       299,
+			Username: "test-user",
+		},
+		apiKey: apiKeyWithErr{
+			APIKey: brain.APIKey{
+				ID:    9202,
+				Label: "test-api-key",
+			},
+		},
+		servers: map[lib.VirtualMachineName]serverWithErr{
+			serverNames[0]: serverWithErr{VirtualMachine: servers[0]},
+			serverNames[1]: serverWithErr{VirtualMachine: servers[1]},
+		},
+		groups: map[lib.GroupName]groupWithErr{
+			groupNames[0]: groupWithErr{Group: groups[0]},
+			groupNames[1]: groupWithErr{Group: groups[1]},
+		},
+		accounts: map[string]accountWithErr{
+			accountNames[0]: accountWithErr{Account: accounts[0]},
+			accountNames[1]: accountWithErr{Account: accounts[1]},
+		},
+		privileges: []privWithErr{{
+			Privilege: brain.Privilege{
+				ID:               14001,
+				Username:         "test-user",
+				Level:            "vm_admin",
+				VirtualMachineID: 1,
+			},
+		}, {
+			Privilege: brain.Privilege{
+				ID:               14002,
+				Username:         "test-user",
+				Level:            "vm_admin",
+				VirtualMachineID: 2,
+			},
+		}, {
+			Privilege: brain.Privilege{
+				ID:       14003,
+				Username: "test-user",
+				Level:    "group_admin",
+				GroupID:  11,
+			},
+		}, {
+			Privilege: brain.Privilege{
+				ID:       14004,
+				Username: "test-user",
+				Level:    "group_admin",
+				GroupID:  12,
+			},
+		}, {
+			Privilege: brain.Privilege{
+				ID:        14005,
+				Username:  "test-user",
+				Level:     "account_admin",
+				AccountID: 21,
+			},
+		}, {
+			Privilege: brain.Privilege{
+				ID:        14006,
+				Username:  "test-user",
+				Level:     "account_admin",
+				AccountID: 22,
+			},
+		}},
+	}}
+
+	for _, test := range tests {
+		// these are common to all the tests so makes no sense to set them in
+		// each test
+		test.CommandT.Auth = true
+		test.CommandT.Commands = add.Commands
+		// hey this way I don't have to type out apikey 80bajillion times
+		test.CommandT.Args = "apikey " + test.CommandT.Args
+
+		// we define the mock requests here so that we can assert on them after
+		// CommandT.Run
+		responseAPIKey := test.apiKey.APIKey
+		responseAPIKey.Privileges = brain.Privileges{}
+		mockPostAPIKey := mocks.Request{
+			StatusCode:     200,
+			ResponseObject: responseAPIKey,
+		}
+
+		test.Run(t, func(t *testing.T, config *mocks.Config, client *mocks.Client, app *cli.App) {
+			config.When("GetVirtualMachine").Return(lib.VirtualMachineName{Group: "default", Account: "default-account"})
+			config.When("GetGroup").Return(lib.GroupName{Group: "default", Account: "default-account"})
+			config.When("GetIgnoreErr", "account").Return("default-account")
+			client.When("GetUser", test.user.Username).Return(test.user, nil)
+
+			if test.apiKey.err {
+				mockPostAPIKey.Err = errors.New("fake error")
+			}
+			for _, privilege := range test.privileges {
+				privRequest := privilege.Privilege
+				privRequest.ID = 0
+				privRequest.APIKeyID = test.apiKey.APIKey.ID
+				privRequest.Username = test.user.Username
+				err := error(nil)
+				if privilege.err {
+					err = errors.New("fake error")
+				}
+				client.When("GrantPrivilege", privRequest).Return(err).Times(1)
+
+			}
+			for serverName, serverWErr := range test.servers {
+				err := error(nil)
+				if serverWErr.err {
+					err = errors.New("fake error")
+				}
+				client.When("GetVirtualMachine", serverName).Return(serverWErr.VirtualMachine, err).Times(1)
+			}
+			for groupName, groupWErr := range test.groups {
+				err := error(nil)
+				if groupWErr.err {
+					err = errors.New("fake error")
+				}
+				client.When("GetGroup", groupName).Return(groupWErr.Group, err).Times(1)
+			}
+			for accountName, accountWErr := range test.accounts {
+				err := error(nil)
+				if accountWErr.err {
+					err = errors.New("fake error")
+				}
+				client.When("GetAccount", accountName).Return(accountWErr.Account, err).Times(1)
+			}
+			// if apiKey label is defined (i.e. we expect to be sending a POST),
+			// we should mock BuildRequest
+			if test.apiKey.Label != "" {
+				client.When("BuildRequest", "POST", lib.BrainEndpoint, "/api_keys", []string(nil)).Return(&mockPostAPIKey).Times(1)
+			}
+		})
+
+		// now assert on all the mock requests
+		if !test.ShouldErr {
+			t.Run(test.CommandT.Name+" AssertRequestObjectEqual", func(t *testing.T) {
+				mockPostAPIKey.T = t
+				if test.apiKey.Label != "" {
+					apiKeyRequest := test.apiKey.APIKey
+					apiKeyRequest.APIKey = ""
+					apiKeyRequest.ID = 0
+					apiKeyRequest.UserID = test.user.ID
+					mockPostAPIKey.AssertRequestObjectEqual(apiKeyRequest)
+				}
+			})
+		}
+	}
+}
diff --git a/cmd/bytemark/commands/add/server_test.go b/cmd/bytemark/commands/add/server_test.go
index 64b77fff..b2313733 100644
--- a/cmd/bytemark/commands/add/server_test.go
+++ b/cmd/bytemark/commands/add/server_test.go
@@ -6,16 +6,14 @@ import (
 	"time"
 
 	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/commands"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/commands/add"
 	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/testutil"
 	"github.com/BytemarkHosting/bytemark-client/lib"
 	"github.com/BytemarkHosting/bytemark-client/lib/brain"
-	"github.com/cheekybits/is"
 	"github.com/urfave/cli"
 )
 
 func TestCreateServerHasCorrectFlags(t *testing.T) {
-	// I'm not sure why this test exists
-	is := is.New(t)
 	seenCmd := false
 	seenAuthKeys := false
 	seenAuthKeysFile := false
@@ -24,8 +22,8 @@ func TestCreateServerHasCorrectFlags(t *testing.T) {
 	seenImage := false
 	seenRootPassword := false
 
-	testutil.TraverseAllCommands(commands.Commands, func(cmd cli.Command) {
-		if cmd.FullName() == "add server" {
+	testutil.TraverseAllCommands(add.Commands, func(cmd cli.Command) {
+		if cmd.Name == "server" {
 			seenCmd = true
 			for _, f := range cmd.Flags {
 				switch f.GetName() {
@@ -45,13 +43,27 @@ func TestCreateServerHasCorrectFlags(t *testing.T) {
 			}
 		}
 	})
-	is.True(seenCmd)
-	is.True(seenAuthKeys)
-	is.True(seenAuthKeysFile)
-	is.True(seenFirstbootScript)
-	is.True(seenFirstbootScriptFile)
-	is.True(seenImage)
-	is.True(seenRootPassword)
+	if !seenCmd {
+		t.Error("Didn't see add server command")
+	}
+	if !seenAuthKeys {
+		t.Error("Didn't see authorized-keys")
+	}
+	if !seenAuthKeysFile {
+		t.Error("Didn't see authorised-keys-file")
+	}
+	if !seenFirstbootScript {
+		t.Error("Didn't see firstboot-script")
+	}
+	if !seenFirstbootScriptFile {
+		t.Error("Didn't see firstboot-script-file")
+	}
+	if !seenImage {
+		t.Error("Didn't see image")
+	}
+	if !seenRootPassword {
+		t.Error("Didn't see root-password")
+	}
 
 }
 
diff --git a/cmd/bytemark/commands/delete/api_key.go b/cmd/bytemark/commands/delete/api_key.go
new file mode 100644
index 00000000..fdc7b689
--- /dev/null
+++ b/cmd/bytemark/commands/delete/api_key.go
@@ -0,0 +1,29 @@
+package delete
+
+import (
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/args"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/with"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/urfave/cli"
+)
+
+func init() {
+	Commands = append(Commands, cli.Command{
+		Name:    "api key",
+		Aliases: []string{"apikey"},
+		Flags: []cli.Flag{
+			cli.StringFlag{
+				Name:  "api-key",
+				Usage: "api key label or ID to delete",
+			},
+		},
+		Action: app.Action(args.Optional("api-key"), with.RequiredFlags("api-key"), with.Auth, func(ctx *app.Context) error {
+			err := brainRequests.DeleteAPIKey(ctx.Client(), ctx.String("api-key"))
+			if err == nil {
+				ctx.Log("Successfully deleted %s", ctx.String("api-key"))
+			}
+			return err
+		}),
+	})
+}
diff --git a/cmd/bytemark/commands/delete/api_key_test.go b/cmd/bytemark/commands/delete/api_key_test.go
new file mode 100644
index 00000000..200ed7f3
--- /dev/null
+++ b/cmd/bytemark/commands/delete/api_key_test.go
@@ -0,0 +1,72 @@
+package delete_test
+
+import (
+	"regexp"
+	"strconv"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/commands/delete"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/mocks"
+	"github.com/urfave/cli"
+)
+
+func TestDeleteAPIKey(t *testing.T) {
+	tests := []struct {
+		testutil.CommandT
+
+		apiKeys brain.APIKeys
+		id      int
+		label   string
+	}{{
+		CommandT: testutil.CommandT{
+			Name: "by id",
+			Args: "2",
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("Successfully deleted 2"),
+			},
+		},
+		id: 2,
+	}, {
+		CommandT: testutil.CommandT{
+			Name: "by label",
+			Args: "jeff",
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("Successfully deleted jeff"),
+			},
+		},
+		apiKeys: brain.APIKeys{{
+			ID:    1,
+			Label: "jeffo",
+		}, {
+			ID:    9,
+			Label: "jeff",
+		}, {
+			ID:    3,
+			Label: "jeffery",
+		}},
+		id:    9,
+		label: "jeff",
+	}}
+
+	for _, test := range tests {
+		test.Args = "apikey " + test.Args
+		test.Commands = delete.Commands
+		test.Auth = true
+		test.Run(t, func(t *testing.T, config *mocks.Config, client *mocks.Client, app *cli.App) {
+			if test.label != "" {
+				apiKeysReq := mocks.Request{
+					StatusCode:     200,
+					ResponseObject: test.apiKeys,
+				}
+				client.When("BuildRequest", "GET", lib.BrainEndpoint, "/api_keys?view=overview", []string(nil)).Return(&apiKeysReq, nil)
+			}
+			deleteReq := mocks.Request{
+				StatusCode: 200,
+			}
+			client.When("BuildRequest", "DELETE", lib.BrainEndpoint, "/api_keys/%s", []string{strconv.Itoa(test.id)}).Return(&deleteReq, nil)
+		})
+	}
+}
diff --git a/cmd/bytemark/commands/show/api_keys.go b/cmd/bytemark/commands/show/api_keys.go
new file mode 100644
index 00000000..76ebb73c
--- /dev/null
+++ b/cmd/bytemark/commands/show/api_keys.go
@@ -0,0 +1,38 @@
+package show
+
+import (
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app"
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/app/with"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/output"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/urfave/cli"
+)
+
+func init() {
+	Commands = append(Commands, cli.Command{
+		Name:        "api keys",
+		Aliases:     []string{"apikeys"},
+		Usage:       "show all your API keys",
+		UsageText:   "show api keys",
+		Description: `Shows all API keys for your user.`,
+		Flags:       app.OutputFlags("API keys", "array"),
+		Action: app.Action(with.Auth, func(ctx *app.Context) error {
+			apiKeys, err := brainRequests.GetAPIKeys(ctx.Client())
+			if err != nil {
+				return err
+			}
+			user, err := ctx.Client().GetUser(ctx.Client().GetSessionUser())
+			if err != nil {
+				return err
+			}
+			myKeys := brain.APIKeys{}
+			for _, key := range apiKeys {
+				if key.UserID == user.ID {
+					myKeys = append(myKeys, key)
+				}
+			}
+			return ctx.OutputInDesiredForm(myKeys, output.List)
+		}),
+	})
+}
diff --git a/cmd/bytemark/commands/show/api_keys_test.go b/cmd/bytemark/commands/show/api_keys_test.go
new file mode 100644
index 00000000..6e6be9c9
--- /dev/null
+++ b/cmd/bytemark/commands/show/api_keys_test.go
@@ -0,0 +1,59 @@
+package show
+
+import (
+	"regexp"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/cmd/bytemark/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/mocks"
+	"github.com/urfave/cli"
+)
+
+func TestShowApiKeys(t *testing.T) {
+	tests := []struct {
+		// CommandT provides all the basics to set up a config, client and app,
+		// all the basic mocks on config, all the stuff to get fake
+		// authentication going, and will run the app and assert a bunch of stuff too
+		testutil.CommandT
+
+		apiKeys brain.APIKeys
+		user    brain.User
+		err     error
+	}{{
+		CommandT: testutil.CommandT{
+			Name: "api keys are listed",
+			Args: "apikeys",
+			OutputMustMatch: []*regexp.Regexp{
+				regexp.MustCompile("special-key.*group jeffgroup"),
+			},
+		},
+		user: brain.User{
+			ID:       100,
+			Username: "jeff",
+		},
+		apiKeys: brain.APIKeys{{
+			UserID: 100,
+			Label:  "special-key",
+			Privileges: brain.Privileges{brain.Privilege{
+				Username:  "jeff",
+				Level:     "group_admin",
+				GroupName: "jeffgroup",
+			}},
+		}},
+	}}
+	for _, test := range tests {
+		test.CommandT.Commands = Commands
+		test.CommandT.Auth = true
+		mockRequest := mocks.Request{
+			StatusCode:     200,
+			ResponseObject: test.apiKeys,
+			Err:            nil,
+		}
+		test.Run(t, func(t *testing.T, config *mocks.Config, client *mocks.Client, app *cli.App) {
+			client.When("BuildRequest", "GET", lib.BrainEndpoint, "/api_keys?view=overview", []string(nil)).Return(&mockRequest, nil)
+			client.When("GetUser", "test-user").Return(test.user, nil)
+		})
+	}
+}
diff --git a/cmd/bytemark/testutil/command_t.go b/cmd/bytemark/testutil/command_t.go
index 4dd5180f..4f3c7224 100644
--- a/cmd/bytemark/testutil/command_t.go
+++ b/cmd/bytemark/testutil/command_t.go
@@ -28,7 +28,7 @@ type CommandT struct {
 	// Args are the command-line arguments to pass to app.Run (after "bytemark")
 	Args string
 	// Commands are the command set to use in the app. TODO: should I default to
-	// main.Commands(Admin)?
+	// main.Commands(Admin)? A: probably
 	Commands []cli.Command
 	// OutputMustMatch are the regexes the output must match
 	OutputMustMatch []*regexp.Regexp
diff --git a/doc/changelog b/doc/changelog
index 0a1338d7..8c49b176 100644
--- a/doc/changelog
+++ b/doc/changelog
@@ -4,6 +4,11 @@ bytemark-client (3.4) UNRELEASED; urgency=low
   * Discs can be moved between servers using the `update disc` command and the
     new `--new-server` flag
   * Grant command can now grant privileges to users using api keys
+  * API keys can be used for authentication (with access restricted to
+    Bytemark Cloud Server's APIs)
+  * API keys can be managed with the `add api key`, `delete api key`, `show
+    api keys`, and `grant privilege` (with --api-key flag) and `revoke
+    privilege` commands.
 
   ### Admin changes:
   * `add vm default` has been added, allowing staff to create
diff --git a/lib/auth.go b/lib/auth.go
index 70ab50d6..99880546 100644
--- a/lib/auth.go
+++ b/lib/auth.go
@@ -3,6 +3,7 @@ package lib
 import (
 	"context"
 	"errors"
+	"strings"
 
 	auth3 "github.com/BytemarkHosting/auth-client"
 )
@@ -22,6 +23,18 @@ func (c *bytemarkClient) AuthWithToken(token string) error {
 		return errors.New("No token provided")
 	}
 
+	if strings.HasPrefix(token, "apikey.") {
+		c.authSession = &auth3.SessionData{
+			Username: "apikeyuser",
+			Factors: []string{
+				"apikey",
+			},
+			Token: token,
+		}
+		c.urls.Billing = ""
+		return nil
+	}
+
 	session, err := c.auth.ReadSession(context.TODO(), token)
 	if err == nil {
 		c.authSession = session
diff --git a/lib/brain/api_key.go b/lib/brain/api_key.go
new file mode 100644
index 00000000..58c5f416
--- /dev/null
+++ b/lib/brain/api_key.go
@@ -0,0 +1,76 @@
+package brain
+
+import (
+	"io"
+	"time"
+
+	"github.com/BytemarkHosting/bytemark-client/lib/output"
+	"github.com/BytemarkHosting/bytemark-client/lib/output/prettyprint"
+)
+
+// APIKey represents an api_key in the brain.
+type APIKey struct {
+	// ID must not be set during creation.
+	ID       int    `json:"id,omitempty"`
+	UserID   int    `json:"user_id,omitempty"`
+	Username string `json:"username,omitempty"`
+	// Label is a friendly display name for this API key
+	Label string `json:"label,omitempty"`
+	// API key is the actual key. To use it, it must be prepended with
+	// 'apikey.' in the HTTP Authorization header. For example, if the api key
+	// is xpq21, the HTTP headers should include `Authorization: Bearer apikey.xpq21`
+	APIKey string `json:"api_key,omitempty"`
+	// ExpiresAt should be a time or datetime in HH:MM:SS or
+	// YYYY-MM-DDTHH:MM:SS.msZ where T is a literal T, .ms are optional
+	// microseconds and Z is either literal Z (meaning UTC) or a timezone
+	// specified like -600 or +1200
+	ExpiresAt string `json:"expires_at,omitempty"`
+	// Privileges cannot be set at creation or update time, but are returned by
+	// the brain when view=overview.
+	Privileges Privileges `json:"privileges,omitempty"`
+}
+
+// DefaultFields returns the list of default fields to feed to github.com/BytemarkHosting/row.From for this type.
+func (key APIKey) DefaultFields(f output.Format) string {
+	switch f {
+	case output.List:
+		return "ID, Label, Expired, ExpiresAt, Privileges"
+	}
+	return "ID, Username, Label, Expired, ExpiresAt, Privileges"
+}
+
+// Expired returns true if ExpiresAt is in the past.
+// This assumes ExpiresAt is in ISO8601 format, which it will be if the APIKey
+// was set by a unmarshalling a response from the brain.
+func (key APIKey) Expired() bool {
+	if key.ExpiresAt == "" {
+		return false
+	}
+	// TODO(telyn): not keen on this ad-hoc iso8601 parsing
+	expiresAt, err := time.Parse("2006-01-02T15:04:05-0700", key.ExpiresAt)
+	if err != nil {
+		return false
+	}
+	return expiresAt.Before(time.Now())
+}
+
+// PrettyPrint outputs a nice human-readable overview of the api key, including
+// what privileges it has, to the given writer.
+func (key APIKey) PrettyPrint(wr io.Writer, detail prettyprint.DetailLevel) error {
+	accountTpl := `
+{{ define "apikey_sgl" }}{{ .Label }}{{ if .Expired }} (expired){{ end }}{{ end }}
+{{ define "apikey_medium" }}{{ template "apikey_sgl" . }}{{ end }}
+{{ define "apikey_full" }}{{ template "apikey_sgl" . }}
+  Expire{{ if .Expired }}d{{ else }}s{{ end }}: {{ if eq .ExpiresAt "" }}never{{ else }}{{ .ExpiresAt }}{{ end -}}
+{{ if .APIKey}}
+  Key: apikey.{{ .APIKey }}{{ end -}}
+{{ if len .Privileges | le 1 }}
+
+  Privileges:
+{{ prettysprint .Privileges "_medium" | prefixEachLine "* " | indent 4 -}}
+{{ else }}
+{{ end -}}
+{{ end }}
+`
+	return prettyprint.Run(wr, accountTpl, "apikey"+string(detail), key)
+}
diff --git a/lib/brain/api_key_test.go b/lib/brain/api_key_test.go
new file mode 100644
index 00000000..4ac208a8
--- /dev/null
+++ b/lib/brain/api_key_test.go
@@ -0,0 +1,93 @@
+package brain_test
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/output/prettyprint"
+)
+
+func TestAPIKeyPrettyPrint(t *testing.T) {
+	tests := []struct {
+		name  string
+		level prettyprint.DetailLevel
+		in    brain.APIKey
+		out   string
+	}{
+		{
+			name:  "single line",
+			level: prettyprint.SingleLine,
+			in: brain.APIKey{
+				Label: "jeff",
+			},
+			out: "jeff",
+		}, {
+			name:  "single line (expired)",
+			level: prettyprint.SingleLine,
+			in: brain.APIKey{
+				Label:     "jeff",
+				ExpiresAt: "2006-01-01T01:01:01.000-0000",
+			},
+			out: "jeff (expired)",
+		}, {
+			name:  "full no privs expired",
+			level: prettyprint.Full,
+			in: brain.APIKey{
+				Label:     "jeff",
+				ExpiresAt: "2006-01-01T01:01:01.0124-0000",
+			},
+			out: `jeff (expired)
+  Expired: 2006-01-01T01:01:01.0124-0000
+`,
+		}, {
+			name:  "full with privs",
+			level: prettyprint.Full,
+			in: brain.APIKey{
+				Label:     "jeff",
+				ExpiresAt: "3000-01-01T01:01:01-0000",
+				Privileges: brain.Privileges{
+					{
+						Username:    "jeffathan",
+						AccountID:   23,
+						AccountName: "jeffadiah",
+						Level:       "account_admin",
+						APIKeyID:    4,
+					},
+				},
+			},
+			out: `jeff
+  Expires: 3000-01-01T01:01:01-0000
+
+  Privileges:
+    * account_admin on account jeffadiah for jeffathan
+`,
+		}, {
+			name:  "full with key",
+			level: prettyprint.Full,
+			in: brain.APIKey{
+				Label:     "jeff",
+				APIKey:    "abcdefgh",
+				ExpiresAt: "3006-01-01T01:01:01-0000",
+			},
+			out: `jeff
+  Expires: 3006-01-01T01:01:01-0000
+  Key: apikey.abcdefgh
+`,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			buf := bytes.Buffer{}
+			err := test.in.PrettyPrint(&buf, test.level)
+			if err != nil {
+				t.Fatal(err)
+			}
+			str := buf.String()
+			if str != test.out {
+				t.Errorf("Output didn't match expected\nexpected: %q\n  actual: %q", test.out, str)
+			}
+		})
+	}
+
+}
diff --git a/lib/brain/api_keys.go b/lib/brain/api_keys.go
new file mode 100644
index 00000000..3aa552de
--- /dev/null
+++ b/lib/brain/api_keys.go
@@ -0,0 +1,31 @@
+package brain
+
+import (
+	"io"
+
+	"github.com/BytemarkHosting/bytemark-client/lib/output"
+	"github.com/BytemarkHosting/bytemark-client/lib/output/prettyprint"
+)
+
+// APIKeys is a slice of APIKey implementing output.Outputtable
+type APIKeys []APIKey
+
+// DefaultFields returns the list of default fields to feed to github.com/BytemarkHosting/row.From for this type.
+func (keys APIKeys) DefaultFields(f output.Format) string {
+	return (APIKey{}).DefaultFields(f)
+}
+
+// PrettyPrint writes a human-readable summary of the API keys to the given
+// writer.
+func (keys APIKeys) PrettyPrint(wr io.Writer, detail prettyprint.DetailLevel) error {
+	keysTpl := `
+{{ define "keys_sgl" }}{{ len . }} API keys{{ end }}
+{{ define "keys_medium" }}
+{{- range . -}}
+{{- prettysprint . "_sgl" }}
+{{ end -}}
+{{ end }}
+{{ define "keys_full" }}{{ template "keys_medium" . }}{{ end }}
+`
+	return prettyprint.Run(wr, keysTpl, "keys"+string(detail), keys)
+}
diff --git a/lib/brain/privilege.go b/lib/brain/privilege.go
index 161ecdae..b7c0ec1a 100644
--- a/lib/brain/privilege.go
+++ b/lib/brain/privilege.go
@@ -52,10 +52,16 @@ type Privilege struct {
 	Username string `json:"username,omitempty"`
 	// VirtualMachineID is the ID of the virtual machine the privilege is granted on
 	VirtualMachineID int `json:"virtual_machine_id,omitempty"`
+	// VirtualMachineName is the name of the virtual machine the privilege is granted on
+	VirtualMachineName string `json:"virtual_machine_name,omitempty"`
 	// AccountID is the ID of the account the privilege is granted on
 	AccountID int `json:"account_id,omitempty"`
+	// AccountID is the name of the account the privilege is granted on
+	AccountName string `json:"account_name,omitempty"`
 	// GroupID is the ID of the group the privilege is granted on
 	GroupID int `json:"group_id,omitempty"`
+	// GroupID is the name of the group the privilege is granted on
+	GroupName string `json:"group_name,omitempty"`
 	// APIKeyID is the ID of the api key required in order to use this Privilege. If not set, privilege relates to normal logins using auth.
 	APIKeyID int `json:"api_key_id,omitempty"`
 	// Level is the PrivilegeLevel they have
@@ -72,11 +78,11 @@ type Privilege struct {
 func (p Privilege) Target() string {
 	switch p.TargetType() {
 	case PrivilegeTargetTypeVM:
-		return fmt.Sprintf("server %d", p.VirtualMachineID)
+		return fmt.Sprintf("server %s", p.VirtualMachineName)
 	case PrivilegeTargetTypeGroup:
-		return fmt.Sprintf("group %d", p.GroupID)
+		return fmt.Sprintf("group %s", p.GroupName)
 	case PrivilegeTargetTypeAccount:
-		return fmt.Sprintf("account %d", p.AccountID)
+		return fmt.Sprintf("account %s", p.AccountName)
 	}
 	return ""
 
@@ -96,11 +102,11 @@ func (p Privilege) String() string {
 	}
 	switch p.TargetType() {
 	case PrivilegeTargetTypeVM:
-		return fmt.Sprintf("%s on VM #%d for %s%s", p.Level, p.VirtualMachineID, p.Username, requiresYubikey)
+		return fmt.Sprintf("%s on VM %s for %s%s", p.Level, p.VirtualMachineName, p.Username, requiresYubikey)
 	case PrivilegeTargetTypeGroup:
-		return fmt.Sprintf("%s on group #%d for %s%s", p.Level, p.GroupID, p.Username, requiresYubikey)
+		return fmt.Sprintf("%s on group %s for %s%s", p.Level, p.GroupName, p.Username, requiresYubikey)
 	case PrivilegeTargetTypeAccount:
-		return fmt.Sprintf("%s on account #%d for %s%s", p.Level, p.AccountID, p.Username, requiresYubikey)
+		return fmt.Sprintf("%s on account %s for %s%s", p.Level, p.AccountName, p.Username, requiresYubikey)
 	}
 	return fmt.Sprintf("%s for %s%s", p.Level, p.Username, requiresYubikey)
 }
diff --git a/lib/output/morestrings/join_with_special_last.go b/lib/output/morestrings/join_with_special_last.go
new file mode 100644
index 00000000..c2598d66
--- /dev/null
+++ b/lib/output/morestrings/join_with_special_last.go
@@ -0,0 +1,21 @@
+package morestrings
+
+import "strings"
+
+// JoinWithSpecialLast joins multiple strings together with a separator, except
+// the last two, which are seperated by a different seperator.
+func JoinWithSpecialLast(sep string, fin string, strs []string) string {
+	// special cases for when there are 0, 1 or 2 strings
+	switch len(strs) {
+	case 0:
+		return ""
+	case 1:
+		return strs[0]
+	case 2:
+		return strs[0] + fin + strs[1]
+	}
+	// join with one seperator
+	most := strings.Join(strs[0:len(strs)-1], sep)
+	// and add the last with the 'fin' seperator.
+	return most + fin + strs[len(strs)-1]
+}
diff --git a/lib/output/morestrings/join_with_special_last_test.go b/lib/output/morestrings/join_with_special_last_test.go
new file mode 100644
index 00000000..822931f9
--- /dev/null
+++ b/lib/output/morestrings/join_with_special_last_test.go
@@ -0,0 +1,40 @@
+package morestrings_test
+
+import (
+	"fmt"
+
+	"github.com/BytemarkHosting/bytemark-client/lib/output/morestrings"
+)
+
+func ExampleJoinWithSpecialLast_oneString() {
+	strs := []string{
+		"hi",
+	}
+	fmt.Print(morestrings.JoinWithSpecialLast(", ", " and ", strs))
+
+	// Output: hi
+}
+func ExampleJoinWithSpecialLast_twoStrings() {
+	strs := []string{
+		"hi", "hello",
+	}
+	fmt.Print(morestrings.JoinWithSpecialLast(", ", " and ", strs))
+
+	// Output: hi and hello
+}
+func ExampleJoinWithSpecialLast_threeStrings() {
+	strs := []string{
+		"hi", "hello", "welcome",
+	}
+	fmt.Print(morestrings.JoinWithSpecialLast(", ", " and ", strs))
+
+	// Output: hi, hello and welcome
+}
+func ExampleJoinWithSpecialLast_long() {
+	strs := []string{
+		"hi", "hello", "welcome", "good evening",
+	}
+	fmt.Print(morestrings.JoinWithSpecialLast(", ", " and ", strs))
+
+	// Output: hi, hello, welcome and good evening
+}
diff --git a/lib/output/prettyprint/template_funcs.go b/lib/output/prettyprint/template_funcs.go
index 39651408..2305e5fb 100644
--- a/lib/output/prettyprint/template_funcs.go
+++ b/lib/output/prettyprint/template_funcs.go
@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"strings"
 	"unicode"
+
+	"github.com/BytemarkHosting/bytemark-client/lib/output/morestrings"
 )
 
 // TemplateFragmentMapper is an interface that requires MapTemplateFragment to exist. The implementation of MapTemplateFragment should add "{{" and "}}" to the beginning and end of template fragment, and run it for each element in the receiver, collecting the output up into an array of strings.
@@ -12,6 +14,16 @@ type TemplateFragmentMapper interface {
 	MapTemplateFragment(templateFrag string) (strs []string, err error)
 }
 
+func prefixEachLine(prefix string, input string) string {
+	lines := strings.Split(input, "\n")
+	for i := range lines {
+		if lines[i] != "" {
+			lines[i] = string(prefix) + lines[i]
+		}
+	}
+	return strings.Join(lines, "\n")
+}
+
 var templateFuncMap = map[string]interface{}{
 	// capitalize the first letter of str
 	"capitalize": func(str string) string {
@@ -39,6 +51,17 @@ var templateFuncMap = map[string]interface{}{
 		}
 		return fmt.Sprintf("%s%d%ciB", lt, size, gt)
 	},
+	// indent indents every line of the input string by n spaces.
+	// for example indent 1 " hi\nhello" would produce "  hi\n hello"
+	"indent": func(amount int, input string) string {
+		spaces := make([]rune, amount)
+		for i := range spaces {
+			spaces[i] = ' '
+		}
+		return prefixEachLine(string(spaces), input)
+
+	},
+	"prefixEachLine": prefixEachLine,
 	// mibgib takes a size in megabytes and formats it with a unit in either MiB or GiB, if size >= 1024.
 	"mibgib": func(size int) string {
 		mg := 'M'
@@ -74,18 +97,8 @@ var templateFuncMap = map[string]interface{}{
 	},
 	// join joins multiple strings together with a separator
 	"join": strings.Join,
-	"joinWithSpecialLast": func(sep string, fin string, strs []string) string {
-		switch len(strs) {
-		case 0:
-			return ""
-		case 1:
-			return strs[0]
-		case 2:
-			return strs[0] + fin + strs[1]
-		}
-		most := strings.Join(strs[0:len(strs)-1], sep)
-		return most + fin + strs[len(strs)-1]
-	},
+	// joinWithSpecialLast joins multiple strings together with a separator, except the last two, which are seperated by a different seperator. e.g. joinWithSpecialLast ", " " and " []string{"hi","hello","welcome","good evening"} would produce "hi, hello, welcome and good evening"
+	"joinWithSpecialLast": morestrings.JoinWithSpecialLast,
 }
 
 // Funcs is not for general usage, only while in transition to PrettyPrint.
diff --git a/lib/requests/brain/create_api_key.go b/lib/requests/brain/create_api_key.go
new file mode 100644
index 00000000..c7a37d4e
--- /dev/null
+++ b/lib/requests/brain/create_api_key.go
@@ -0,0 +1,40 @@
+package brain
+
+import (
+	"errors"
+
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+)
+
+// CreateAPIKey creates an API key for the given user, then returns it.
+// Neither the ID nor APIKey field should be specified in the spec.
+// username may be blank if the spec.UserID is set.
+func CreateAPIKey(client lib.Client, username string, spec brain.APIKey) (apiKey brain.APIKey, err error) {
+	if len(spec.Privileges) > 0 {
+		err = errors.New("CreateAPIKey does not support creating an APIKey with privileges already attached - please use GrantPrivilege after CreateAPIKey, and provide an APIKey with Privileges unset to CreateAPIKey")
+		return
+	}
+	if spec.UserID != 0 && username != "" {
+		err = errors.New("only specify one of username and spec.UserID")
+		return
+	}
+	if spec.UserID == 0 && username == "" {
+		err = errors.New("one of user and spec.UserID must be specified")
+		return
+	}
+	if spec.UserID == 0 {
+		var user brain.User
+		user, err = client.GetUser(username)
+		if err != nil {
+			return
+		}
+		spec.UserID = user.ID
+	}
+	r, err := client.BuildRequest("POST", lib.BrainEndpoint, "/api_keys")
+	if err != nil {
+		return
+	}
+	_, _, err = r.MarshalAndRun(spec, &apiKey)
+	return
+}
diff --git a/lib/requests/brain/create_api_key_test.go b/lib/requests/brain/create_api_key_test.go
new file mode 100644
index 00000000..2f4a083e
--- /dev/null
+++ b/lib/requests/brain/create_api_key_test.go
@@ -0,0 +1,141 @@
+package brain_test
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil/assert"
+)
+
+func TestCreateAPIKey(t *testing.T) {
+	tests := []struct {
+		name string
+		user string
+		spec brain.APIKey
+		// if the user ID needs to be retrieved from the api (when user == "" and spec.UserID == 0)
+		// then specify the user id to return here
+		userID          int
+		requestExpected map[string]interface{}
+		response        brain.APIKey
+		responseErr     error
+
+		shouldErr bool
+	}{
+		{
+			name: "neither user nor UserID set",
+			spec: brain.APIKey{
+				ExpiresAt: "2018-03-03T03:03:03Z",
+			},
+			shouldErr: true,
+		}, {
+			name: "both user and UserID set",
+			user: "jeff",
+			spec: brain.APIKey{
+				UserID:    4123.0,
+				ExpiresAt: "2018-03-03T03:03:03Z",
+			},
+			shouldErr: true,
+		}, {
+			name: "user set",
+			user: "jeff",
+			spec: brain.APIKey{
+				ExpiresAt: "2019-04-04T04:04:04Z",
+			},
+			userID: 1111,
+			requestExpected: map[string]interface{}{
+				"user_id":    1111.0,
+				"expires_at": "2019-04-04T04:04:04Z",
+			},
+			response: brain.APIKey{
+				ID:        9,
+				APIKey:    "fake-api-key",
+				UserID:    1111,
+				ExpiresAt: "2019-04-04T04:04:04Z",
+			},
+		}, {
+			name: "UserID set",
+			spec: brain.APIKey{
+				UserID:    4123,
+				ExpiresAt: "2018-05-05T05:05:05Z",
+				Label:     "jeffs-cool-key-for-arctic-exploration",
+			},
+			requestExpected: map[string]interface{}{
+				"user_id":    4123.0,
+				"expires_at": "2018-05-05T05:05:05Z",
+				"label":      "jeffs-cool-key-for-arctic-exploration",
+			},
+			response: brain.APIKey{
+				ID:        12435,
+				APIKey:    "this-key-be-fake",
+				UserID:    4123,
+				Label:     "jeffs-cool-key-for-arctic-exploration",
+				ExpiresAt: "2018-05-05T05:05:05Z",
+			},
+		}, {
+			name: "error!!",
+			spec: brain.APIKey{
+				UserID:    4123,
+				ExpiresAt: "2018-05-05T05:05:05Z",
+			},
+			requestExpected: map[string]interface{}{
+				"user_id":    4123.0,
+				"expires_at": "2018-05-05T05:05:05Z",
+			},
+			shouldErr:   true,
+			responseErr: errors.New("the turboencabulator couldn't effectively prevent side fumbling"),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			rts := testutil.RequestTestSpec{
+				MuxHandlers: &testutil.MuxHandlers{
+					Brain: testutil.Mux{
+						"/api_keys": func(wr http.ResponseWriter, r *http.Request) {
+							assert.Equal(t, "method", "POST", r.Method)
+							assert.BodyUnmarshalEqual(test.requestExpected)(t, "request", r)
+
+							if test.responseErr != nil {
+								wr.WriteHeader(500)
+								wr.Write([]byte(test.responseErr.Error()))
+							}
+							bytes, err := json.Marshal(test.response)
+							if err != nil {
+								t.Fatal(err)
+							}
+							wr.Write(bytes)
+						},
+					},
+				},
+			}
+			if test.userID != 0 {
+				rts.MuxHandlers.Brain["/users/"+test.user] = func(wr http.ResponseWriter, r *http.Request) {
+					assert.Equal(t, "", "GET", r.Method)
+					bytes, err := json.Marshal(brain.User{ID: test.userID})
+					if err != nil {
+						t.Fatal(err)
+					}
+					wr.Write(bytes)
+				}
+			}
+
+			rts.Run(t, "", true, func(client lib.Client) {
+				apikey, err := brainRequests.CreateAPIKey(client, test.user, test.spec)
+				if err != nil && !test.shouldErr {
+					t.Errorf("Unexpected error: %v", err)
+				} else if err == nil && test.shouldErr {
+					t.Error("Error expected but not returned")
+				}
+
+				if !test.shouldErr {
+					assert.Equal(t, "response", test.response, apikey)
+				}
+			})
+		})
+	}
+}
diff --git a/lib/requests/brain/delete_api_key.go b/lib/requests/brain/delete_api_key.go
new file mode 100644
index 00000000..f9f27162
--- /dev/null
+++ b/lib/requests/brain/delete_api_key.go
@@ -0,0 +1,37 @@
+package brain
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+)
+
+// DeleteAPIKey takes an API key id or label and revokes it.
+func DeleteAPIKey(client lib.Client, id string) (err error) {
+	if _, convErr := strconv.Atoi(id); convErr != nil {
+		var apikeys brain.APIKeys
+		apikeys, err = GetAPIKeys(client)
+		if err != nil {
+			return err
+		}
+		found := false
+		for _, k := range apikeys {
+			if k.Label == id {
+				id = strconv.Itoa(k.ID)
+				found = true
+			}
+		}
+		if !found {
+			return fmt.Errorf("Could not find an api key called %q", id)
+		}
+	}
+	r, err := client.BuildRequest("DELETE", lib.BrainEndpoint, "/api_keys/%s", id)
+	if err != nil {
+		return
+	}
+
+	_, _, err = r.Run(nil, nil)
+	return
+}
diff --git a/lib/requests/brain/delete_api_key_test.go b/lib/requests/brain/delete_api_key_test.go
new file mode 100644
index 00000000..cd1e9c6e
--- /dev/null
+++ b/lib/requests/brain/delete_api_key_test.go
@@ -0,0 +1,87 @@
+package brain_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil/assert"
+)
+
+func TestDeleteAPIKey(t *testing.T) {
+	tests := []struct {
+		name       string
+		id         int
+		labelOrID  string
+		statusCode int
+		shouldErr  bool
+		apiKeys    brain.APIKeys
+	}{
+		{
+			name:       "success",
+			id:         9,
+			labelOrID:  "9",
+			statusCode: 200,
+			shouldErr:  false,
+		}, {
+			name:       "successjumanji",
+			id:         229,
+			labelOrID:  "jumanji",
+			statusCode: 200,
+			shouldErr:  false,
+			apiKeys: brain.APIKeys{{
+				ID:    442,
+				Label: "not-jumanji",
+			}, {
+				ID:    229,
+				Label: "jumanji",
+			}},
+		}, {
+			name:       "error 500",
+			id:         25,
+			labelOrID:  "25",
+			statusCode: 500,
+			shouldErr:  true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			rts := testutil.RequestTestSpec{
+				MuxHandlers: &testutil.MuxHandlers{
+					Brain: testutil.Mux{
+						fmt.Sprintf("/api_keys/%d", test.id): func(wr http.ResponseWriter, r *http.Request) {
+							assert.BodyString("")(t, "", r)
+							assert.Method("DELETE")(t, "", r)
+							wr.WriteHeader(test.statusCode)
+						},
+						"/api_keys": func(wr http.ResponseWriter, r *http.Request) {
+							assert.Method("GET")(t, "", r)
+							bs, err := json.Marshal(test.apiKeys)
+							if err != nil {
+								t.Fatalf("json marshal failed: %s", err)
+							}
+							_, err = wr.Write(bs)
+							if err != nil {
+								t.Fatalf("http write failed %s", err)
+							}
+						},
+					},
+				},
+			}
+			rts.Run(t, test.name, true, func(client lib.Client) {
+				err := brainRequests.DeleteAPIKey(client, test.labelOrID)
+				if err != nil && !test.shouldErr {
+					t.Errorf("Unexpected error: %v", err)
+				} else if err == nil && test.shouldErr {
+					t.Error("Error expected but not returned")
+				}
+			})
+		})
+	}
+}
diff --git a/lib/requests/brain/get_api_keys.go b/lib/requests/brain/get_api_keys.go
new file mode 100644
index 00000000..220dc42b
--- /dev/null
+++ b/lib/requests/brain/get_api_keys.go
@@ -0,0 +1,18 @@
+package brain
+
+import (
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+)
+
+// GetAPIKeys gets all API keys that you can currently see.
+// In general this means those for your user, but users with cluster_admin
+// will be able to see all API keys on the cluster
+func GetAPIKeys(client lib.Client) (apiKeys brain.APIKeys, err error) {
+	r, err := client.BuildRequest("GET", lib.BrainEndpoint, "/api_keys?view=overview")
+	if err != nil {
+		return
+	}
+	_, _, err = r.Run(nil, &apiKeys)
+	return
+}
diff --git a/lib/requests/brain/get_api_keys_test.go b/lib/requests/brain/get_api_keys_test.go
new file mode 100644
index 00000000..bb92e29f
--- /dev/null
+++ b/lib/requests/brain/get_api_keys_test.go
@@ -0,0 +1,75 @@
+package brain_test
+
+import (
+	"testing"
+
+	"github.com/BytemarkHosting/bytemark-client/lib"
+	"github.com/BytemarkHosting/bytemark-client/lib/brain"
+	brainRequests "github.com/BytemarkHosting/bytemark-client/lib/requests/brain"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil"
+	"github.com/BytemarkHosting/bytemark-client/lib/testutil/assert"
+)
+
+func TestGetAPIKeys(t *testing.T) {
+	tests := []struct {
+		name       string
+		response   brain.APIKeys
+		statusCode int
+		shouldErr  bool
+	}{
+		{
+			name: "empty array",
+		},
+		{
+			name:       "http 500",
+			statusCode: 500,
+			shouldErr:  true,
+		},
+		{
+			name: "some keys",
+			response: brain.APIKeys{
+				{
+					ID:        6,
+					UserID:    2152,
+					Label:     "gitlab-autoscaling",
+					APIKey:    "extremelyrandomdatahereuhhhhh7",
+					ExpiresAt: "2019-03-21T00:24:45.0312Z",
+					Privileges: brain.Privileges{
+						{
+							Username: "dr-gitlabotopis",
+							APIKeyID: 6,
+							GroupID:  2433,
+							Level:    "group_admin",
+						},
+					},
+				}, {
+					ID:     912,
+					UserID: 2505,
+					Label:  "kubernetes-cloud-controller-manager",
+					APIKey: "keykeykeykeykeynoonesgonnaguessthat",
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			rts := testutil.RequestTestSpec{
+				Method:     "GET",
+				Endpoint:   lib.BrainEndpoint,
+				URL:        "/api_keys",
+				StatusCode: test.statusCode,
+				Response:   test.response,
+			}
+			rts.Run(t, test.name, true, func(client lib.Client) {
+				keys, err := brainRequests.GetAPIKeys(client)
+				if err != nil && !test.shouldErr {
+					t.Errorf("Unexpected error: %v", err)
+				} else if err == nil && test.shouldErr {
+					t.Error("Error expected but not returned")
+				}
+				assert.Equal(t, "api keys", test.response, keys)
+			})
+		})
+	}
+}
diff --git a/lib/testutil/request_test_spec.go b/lib/testutil/request_test_spec.go
index c4c6bb7b..7c3998d8 100644
--- a/lib/testutil/request_test_spec.go
+++ b/lib/testutil/request_test_spec.go
@@ -21,7 +21,8 @@ type RequestTestFunc func(lib.Client)
 type RequestTestSpec struct {
 	// MuxHandlers will be used if defined - this allows for the test to support
 	// multiple endpoints, URLs, methods, etc. while still keeping as DRY as
-	// possible. Otherwise, set the Method, Endpoint, URL, ExpectedRequest, and Response fields.
+	// possible. Otherwise, set the Method, Endpoint, URL, AssertRequest,
+	// Response and StatusCode.
 	MuxHandlers *MuxHandlers
 
 	// Method is used to assert that the request was given the correct type
@@ -35,6 +36,10 @@ type RequestTestSpec struct {
 	// to use a raw string (i.e. if you don't want to use JSON) cast it to
 	// encoding/json.RawMessage - this will be reproduced verbatim
 	Response interface{}
+	// StatusCode is the status code that will be returned. If unset, will
+	// default to whatever http.ResponseWriter.Write defaults to.
+	// Only used if MuxHandlers is nil
+	StatusCode int
 	// AssertRequest is an optional func which will get called to check the
 	// request object further - for example to check the URL has particular
 	// query string keys
@@ -59,6 +64,9 @@ func (rts *RequestTestSpec) handlerFunc(t *testing.T, testName string, auth bool
 		if rts.AssertRequest != nil {
 			rts.AssertRequest(t, testName, r)
 		}
+		if rts.StatusCode != 0 {
+			wr.WriteHeader(rts.StatusCode)
+		}
 		WriteJSON(t, wr, rts.Response)
 	}
 }
diff --git a/mocks/request.go b/mocks/request.go
index ca1d265c..4f50c0b4 100644
--- a/mocks/request.go
+++ b/mocks/request.go
@@ -84,7 +84,7 @@ func (r *Request) fillOut(out interface{}) {
 	}
 	outVal := reflect.ValueOf(out)
 	if resVal.Type().AssignableTo(outVal.Type()) {
-		r.T.Fatalf("ResponseBody %s was not assignable to out %s", resVal.Type(), outVal.Type())
+		r.T.Fatalf("ResponseObject %s was not assignable to out %s", resVal.Type(), outVal.Type())
 	}
 	outVal.Elem().Set(resVal)
 }