API keys

API keys are managed from Dashboard → API keys by administrators and owners in a paid workspace. Create a key with a clear service-specific name, select exactly one scope—read, write, or admin—and optionally set an expiry. Scope is hierarchical: write satisfies read, and admin satisfies both lower levels. Some owner-only REST operations also require that the key was created by the current owner.

The full secret appears only once at creation. Store it immediately in a server-side secret manager; later lists intentionally show only a prefix and metadata. Never embed it in browser code, a widget configuration, mobile application, or support transcript. Use a separate key per deployment or integration so a suspected leak can be contained without interrupting unrelated services.

Revoking a key immediately breaks callers using it. Before revocation, deploy a replacement where needed and monitor the integration for authentication failures. For request headers, response envelopes, rate limits, and endpoint workflows, use the Developers REST API guides and generated reference rather than treating the key list as an API console.