Create and revoke API keys

API keys provide tenant-scoped, read-only access to the supported API endpoints. They are not individually scopeable. A workspace can have up to ten active keys, and the secret is shown only at creation.

Before you start

• Only a workspace admin can manage keys.

• Prepare an approved secret manager, a meaningful integration name and an owner before creating the key.

Step by step

1. Create a named key

Open Settings → API, choose Create API key and name it for the consuming system and environment—for example, Reporting production.

2. Copy the secret once

Copy the displayed token immediately into the approved secret manager. Do not close the dialog until the saved value has been verified.

3. Authenticate requests

Send the token in the Authorization header as a Bearer credential to the documented read-only endpoints for projects, vendors or the software register.

4. Monitor ownership and use

Return to the key list to review name, creation and last-used information. Replace unowned or unexpectedly used keys.

5. Revoke permanently

Choose Revoke when an integration is retired, the secret is exposed or access is no longer justified. Revocation cannot be undone; create a replacement key if needed.

What happens next

• The integration can read only the tenant data exposed by the supported endpoints; normal data-handling obligations still apply.

• Rotate keys by creating and deploying a replacement before revoking the old one.

Troubleshooting

The secret is no longer visible

This is intentional. Revoke the old key and create a replacement; the existing secret cannot be recovered.

Creation is blocked

Confirm admin access and remove an unused key if the workspace already has ten active keys.

Requests return unauthorised

Check the Authorization: Bearer header, ensure the full token was stored and confirm the key has not been revoked.

A write request fails

Workspace API keys are read-only. Use a supported product workflow for changes.

Related guides