Skip to main content
API keys are the only authentication method for the public developer API. They are created in the dashboard, never through a public endpoint.

​
Format

The pair is generated with a cryptographically secure random source. The secret is stored as a hash; the full secret is returned only at creation or rotation. If you lose it, rotate the key.

​
Creating a key

From the dashboard’s API key area for your company:
  1. Name the key for the integration it serves.
  2. Select scopes. Start from a preset or choose individually.
  3. Optionally restrict the key to one or more buckets.
  4. Choose an environment label: development, staging, or production.
  5. Choose an expiry. The default is 90 days; null means no expiry.
  6. Complete step-up authentication.
  7. Copy both values immediately.

​
Prerequisites enforced by the backend

If creation fails, fix the account state. There is no API-side workaround.

​
Scope presets

The dashboard offers three convenience presets: mcp is never included in a preset. Add it explicitly only if you are building an MCP client. See Scopes and permissions.
“Full Access” means full access to the storage surface for the buckets the key can see. It does not grant bucket creation, deletion, sharing, billing, or administration.

​
Bucket restriction

A key can be unrestricted or limited to specific buckets. The restriction is enforced before the operation runs and before trial accounting. Attempts outside the scope return 403 API_BUCKET_SCOPE_DENIED. A restricted key can only reach the buckets it is scoped to. It cannot operate on other buckets, and the bucket list shows it only the buckets it is scoped to.

​
Environment label

The environment label is metadata recorded with usage events. It does not create a separate API host, dataset, or isolation boundary. For real isolation, use a separate company workspace with separate keys. This documentation does not describe a sandbox base URL.

​
Expiry

expiresInDays accepts 1 to 365, or null for no expiry. The default is 90 days. Expired keys fail authentication immediately. There is no grace period documented. Plan rotation before expiry, especially for unattended jobs.

​
Rotation

Rotation creates a new public/secret pair for the same key record. Update your deployed secret, verify a request succeeds, then discard the old pair. A safe sequence:
  1. Rotate in the dashboard.
  2. Write the new pair to your secret manager.
  3. Deploy or restart the consumer.
  4. Verify a read request.
  5. Confirm no traffic is still using the old pair.
Because the old pair stops working at rotation, plan a short maintenance window or a blue/green deployment where both versions can read the new secret.

​
Revocation

Revocation is immediate. Use it when:
  • a secret may have leaked,
  • an integration is retired,
  • a contractor or member loses access,
  • usage looks anomalous.
Revoke first, investigate second. Keys cannot be un-revoked; create a replacement.

​
Key management through the API

There is no public API-key creation endpoint for developer integrations. Key management routes are session-only and require dashboard privileges plus step-up verification. They are intentionally excluded from this reference.

​
Storage guidance

​
Troubleshooting