Skip to main content

​
API keys

Send your key as a bearer token:
A key belongs to your organization, not to the person who created it, so it keeps working if that person leaves. Revoke it when you no longer need it. Keep keys on your server. For browsers and mobile apps, use a client token.
Creating, editing and rotating keys requires a login session, so a leaked key can’t create more keys. A key with the right scopes can list and revoke keys.

​
Client tokens

A client token is a short-lived credential that’s safe to give to a browser or mobile app. Your server creates one with POST /v1/client-tokens, and it lasts up to one hour, or 15 minutes by default. A token’s scopes can’t exceed those of the key that created it. A token keeps working until it expires, even if that key is revoked, so keep lifetimes short.

​
Scopes

Each key has a list of scopes. A request without the scope it needs returns 403, with the code missing_scope. You can’t give a key a scope that your own role doesn’t include. GET /v1/roles lists what each role can do.