API Keys
An API key authenticates requests made outside the browser — scripts, pipelines, your own services — against the REST API.
Find them under Settings → API Keys. Every signed-in user can list their own keys; administrators see every key in the organization.
Creating a key
Creation is two steps, and the order matters: you choose where the key can act before you choose what it can do.
Step 1 — Access
Pick the key's Space access:
- All Spaces — every Space, present and future. A Space created next month is covered automatically.
- Specific Spaces — the key acts only in the Spaces you select.
Step 2 — Permissions
Permissions come in two kinds, and they behave differently:
| Kind | Where it applies |
|---|---|
| Global permissions | Organization-wide. They take no Space at all. |
| Space-scoped permissions | Only the Spaces chosen in step 1. |
This is the part most often got wrong: a key that carries only global permissions needs no Space. The Space selection exists for the space-scoped half. Selecting Spaces for a purely global key changes nothing.
A key must carry at least one permission, and its name must be between 3 and 50 characters.
The secret is shown once
When the key is created its secret is displayed a single time.
The secret is never shown again. If you lose it, the only path forward is to revoke the key and create a new one.
Treat it as a password:
- Do not commit it to version control or paste it anywhere public.
- Anyone holding the key has the key's access to the associated Spaces.
- Rotate keys on a schedule rather than after an incident.
Managing keys
The list shows each key's name, masked secret, permission count, Space, creation date and creator, and can be filtered by creator, date and Space. Two tabs separate Organization-wide keys from Space keys.
Editing a key changes its name and details only — the secret value is untouched, so renaming a key never breaks a running integration.
Revoking permanently disables the key. It cannot be undone and takes effect immediately: anything still presenting that key starts failing. Rotate by creating the replacement first, cutting traffic over, and revoking the old key afterwards.
API Keys sit behind an organization feature flag. If the section is missing from your settings hub, it is not enabled for your organization.
Next steps
- API reference — the endpoints a key gets you.
- Permissions — how seats and permissions resolve.
- Spaces — what a Space scopes.