API keys

Administrators and owners in a paid workspace manage API keys from Dashboard → API keys.

To create a key, give it a clear, service-specific name. Select one scope: read, write, or admin. You can also set an expiry date.

Scope is hierarchical. Write scope includes read scope. Admin scope includes both lower scopes.

Some owner-only REST operations also require that the current owner created the key.

The full secret appears only once, at creation. Store it immediately in a server-side secret manager.

Later lists show only a prefix and metadata. This is intentional.

Do not put the secret in browser code, a widget configuration, a mobile app, or a support transcript.

Use a separate key for each deployment or integration. Then you can contain a suspected leak without stopping unrelated services.

When you revoke a key, callers that use it stop working immediately.

Before you revoke a key, deploy a replacement key where you need one. Then monitor the integration for authentication failures.

For request headers, response envelopes, rate limits, and endpoint workflows, use the Developers REST API guides and the generated reference. Do not use the key list as an API console.