You can create an initial full access User using the console. https://console.truevault.com -> Users -> Create New User. Upon creation, clicking into the User should show the API Key. This User will have full CRUDA privileges on all resources, so it's unsafe to use this User's API Key for an application.
In order to create a User with limited privileges, you should not create a User through the console. You can use the API Key of one of the Users created in the console to create another User using our Users API. Check out https://docs.truevault.com/Users.html to see how to do so.
We recommend using environment variables to represent API Keys or any other sensitive data in your application.