diff --git a/pkg/app/api/grpcapi/web_api.go b/pkg/app/api/grpcapi/web_api.go
index fc494a0106..2456c18646 100644
--- a/pkg/app/api/grpcapi/web_api.go
+++ b/pkg/app/api/grpcapi/web_api.go
@@ -1202,3 +1202,15 @@ L:
 	}
 	return filtered
 }
+
+func (a *WebAPI) GenerateAPIKey(ctx context.Context, req *webservice.GenerateAPIKeyRequest) (*webservice.GenerateAPIKeyResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "")
+}
+
+func (a *WebAPI) DisableAPIKey(ctx context.Context, req *webservice.DisableAPIKeyRequest) (*webservice.DisableAPIKeyResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "")
+}
+
+func (a *WebAPI) ListAPIKeys(ctx context.Context, req *webservice.ListAPIKeysRequest) (*webservice.ListAPIKeysResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "")
+}
diff --git a/pkg/app/api/service/webservice/service.proto b/pkg/app/api/service/webservice/service.proto
index 440717b976..25e24820b0 100644
--- a/pkg/app/api/service/webservice/service.proto
+++ b/pkg/app/api/service/webservice/service.proto
@@ -28,6 +28,7 @@ import "pkg/model/logblock.proto";
 import "pkg/model/piped.proto";
 import "pkg/model/role.proto";
 import "pkg/model/project.proto";
+import "pkg/model/apikey.proto";
 import "google/protobuf/wrappers.proto";
 
 // WebService contains all RPC definitions for web client.
@@ -79,6 +80,11 @@ service WebService {
 
     // Deployment Config Template
     rpc ListDeploymentConfigTemplates(ListDeploymentConfigTemplatesRequest) returns (ListDeploymentConfigTemplatesResponse) {}
+
+    // API Key
+    rpc GenerateAPIKey(GenerateAPIKeyRequest) returns (GenerateAPIKeyResponse) {}
+    rpc DisableAPIKey(DisableAPIKeyRequest) returns (DisableAPIKeyResponse) {}
+    rpc ListAPIKeys(ListAPIKeysRequest) returns (ListAPIKeysResponse) {}
 }
 
 message AddEnvironmentResponse {
@@ -368,3 +374,30 @@ message ListDeploymentConfigTemplatesRequest {
 message ListDeploymentConfigTemplatesResponse {
     repeated DeploymentConfigTemplate templates = 1;
 }
+
+message GenerateAPIKeyRequest {
+    string name = 1 [(validate.rules).string.min_len = 1];
+    model.APIKey.Role role = 2 [(validate.rules).enum.defined_only = true];
+}
+
+message GenerateAPIKeyResponse {
+    model.APIKey key = 1;
+}
+
+message DisableAPIKeyRequest {
+    string id = 1 [(validate.rules).string.min_len = 1];
+}
+
+message DisableAPIKeyResponse {
+}
+
+message ListAPIKeysRequest {
+    message Options {
+        google.protobuf.BoolValue enabled = 1;
+    }
+    Options options = 2;
+}
+
+message ListAPIKeysResponse {
+    repeated model.APIKey keys = 1;
+}
diff --git a/pkg/model/BUILD.bazel b/pkg/model/BUILD.bazel
index 1bd1f98f7a..4388a9cb63 100644
--- a/pkg/model/BUILD.bazel
+++ b/pkg/model/BUILD.bazel
@@ -4,6 +4,7 @@ load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 proto_library(
     name = "model_proto",
     srcs = [
+        "apikey.proto",
         "application.proto",
         "application_live_state.proto",
         "command.proto",
diff --git a/pkg/model/apikey.proto b/pkg/model/apikey.proto
new file mode 100644
index 0000000000..74a7c1aca1
--- /dev/null
+++ b/pkg/model/apikey.proto
@@ -0,0 +1,48 @@
+// Copyright 2020 The PipeCD Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package pipe.model;
+option go_package = "github.com/pipe-cd/pipe/pkg/model";
+
+import "validate/validate.proto";
+import "pkg/model/common.proto";
+
+message APIKey {
+    enum Role {
+        READ_ONLY = 0;
+        READ_WRITE = 1;
+    }
+
+    // The unique ID of the key.
+    string id = 1 [(validate.rules).string.min_len = 1];
+    // The name of the key.
+    string name = 2 [(validate.rules).string.min_len = 1];
+    // The key string.
+    string key = 3 [(validate.rules).string.min_len = 1];
+    // The project this key belongs to.
+    string project = 4 [(validate.rules).string.min_len = 1];
+    // The role of the key.
+    Role role = 5 [(validate.rules).enum.defined_only = true];
+    // Who created the key.
+    string creator = 6 [(validate.rules).string.min_len = 1];
+
+    // Whether the key is disabled or not.
+    bool disabled = 13;
+    // Unix time when the key was created.
+    int64 created_at = 14  [(validate.rules).int64.gt = 0];
+    // Unix time of the last time when the key was updated.
+    int64 updated_at = 15 [(validate.rules).int64.gt = 0];
+}