Skip to main content
An API key lets a script, a CI job, or an integration call the API without a browser session. This page covers creating a key, the one decision that matters most — whose identity it carries — and how revocation behaves. Manage keys under Settings → API keys.

​
Creating a key

Choose New API key and set four things: The full token is shown once at creation. You do not have to capture it perfectly — it can be revealed again from the API keys screen — but every reveal is recorded in the audit log.

​
Whose identity the key carries

This is the decision worth getting right.
For anything that has to keep running, prefer a service-account key. A key that acts as a person is a dependency on that person’s membership.

​
Using a key

Send the token as a bearer token on each request:

​
Lifecycle

  • Status — a key is active, expired, or revoked.
  • Last used — the keys screen shows when each key was last seen, which is how you find the ones nothing uses any more.
  • Revoke — takes effect immediately and cannot be undone, so issue a replacement first if the integration has to keep running. Revoking a key that minted its own service account also disables that service account; a key bound to a shared service account, or to you, never touches that identity.
  • A key also stops working the moment the identity behind it does. Disabling a service account or suspending a member immediately invalidates every key bound to it.

​
Next steps

Service accounts

The identity most keys should act as.

Roles & permissions

The roles a service-account key is granted at creation.

APIs

What you can call once you hold a key.

Audit log

Creation, reveals, and revocations are all recorded.