Overview
Create and manage API keys for programmatic access
API keys authenticate requests from your applications and services. Each key is scoped to your organization — all API calls made with a key create and access resources within that organization.
| Method | Endpoint | Quick Link |
|---|---|---|
POST | /user/api-keys | Create an API key |
GET | /user/api-keys | List API keys |
DELETE | /user/api-keys/{api_key_id} | Archive an API key |
PUT | /user/api-keys/{api_key_id}/reactivate | Reactivate an API key |
Best practices#
- Use one key per environment — separate keys for development, staging, and production make rotation easy and limit blast radius if a key is compromised.
- Use one key per service — this allows you to revoke a single service's access without affecting others.
- Rotate keys regularly — create a new key, update your secret store, then archive the old key.
- Never hardcode keys — use environment variables or a secrets manager. Never commit keys to version control.
- Monitor
last_used_at— keys with no recent activity may be safe to archive.
How to use this reference#
Use this page as the entry point for the related API endpoints. Open the endpoint-specific page when you need the exact method, path, request body, response schema, and OpenAPI details.
Implementation checklist#
- Start with the overview table to choose the correct endpoint.
- Confirm authentication and organization scope before calling the endpoint from code.
- Test with a small request first, then inspect the response and error handling path.