API
Manage API keys
Reveal, rotate, and scope API keys without exposing credentials to browsers or client applications.
Developers and workspace administrators8 minutes
Before you begin
- Permission to manage API credentials
What you will complete
- A least-privileged API key stored in a server-side secret manager
Obtain and store the key
Open Settings > API and reveal the key only in a private environment. Store it in a server-side secret manager or deployment environment variable.
Never place an API key in browser JavaScript, a mobile binary, screenshots, support messages, or source control.
Set permissions
- Grant only the resource permissions the integration uses.
- Use the correct workspace or team context.
- Keep test and production credentials separate.
- Document the owning service and rotation contact.
Rotate safely
- 1Prepare the consuming serviceMake sure the service can accept the replacement secret without a code release where possible.
- 2Rotate in SignaGenerate the replacement and update the secret store immediately.
- 3Test a low-risk requestConfirm authentication and permissions before normal traffic resumes.