Create a key
Only Owners and Administrators can create keys, and only from a signed-in console session. An API key cannot create, list or revoke keys, so a leaked key can never mint itself a replacement.- Open Operations → API keys and select New API key.
- Enter a Name that says what uses it, such as “Support portal integration”. It appears in your audit trail.
-
Choose a Role. Pick the narrowest that works:
You cannot create a key with a role above your own.
- Choose when it Expires: 30 days, 90 days, 1 year or never. An expiring key limits how long a leaked credential stays useful.
- Select Create, then copy the key now. It is shown once and cannot be retrieved later.
Use a key
Send it as a bearer token:Rotate a key
Rotation is two steps, so nothing breaks in between:- Create a new key with the same role, and deploy it to the integration.
- Once the integration is using the new key, revoke the old one.
Revoke a key
Select Revoke next to the key in Operations → API keys. Revocation:- takes effect on the next request, with no delay or cache;
- is permanent: a revoked key cannot be reactivated;
- keeps the key in the list as revoked, so access reviews can see it existed.
If a key is exposed, in a commit, a log, a support ticket or a web page, revoke it first, then
create a replacement.
Keep keys safe
- Store keys in a secret manager, never in source code or a committed
.envfile. - Never put a key in a browser, a mobile app or any HTML. For websites, use the widget, which has its own public key.
- Give each integration its own key, so you can revoke one without affecting the others.
- Set an expiry where you can, and review Last used regularly to revoke keys nobody uses.
Errors
For the endpoints, see API keys in the API reference.