API Keys
Create and manage the keys that authenticate your API requests.
Create keys on the API Keys page. Every API request sends one as a Bearer token:
Authorization: Bearer YOUR_API_KEYScope & safety
- A key acts as your account (or your org, if created in an org workspace) — treat it like a password
- Keys are shown once at creation — store them in your secret manager immediately
- Revoke any key from the same page; revocation is immediate
- Rotate keys that were ever pasted into shared docs, tickets, or client-side code
Never ship an API key in frontend/browser code — anyone can read it there. Call our API from your backend (see the Next.js guide) and keep the key server-side.
Org vs personal keys
Keys belong to the workspace they were created in. Create keys in your organization workspace for team/production use — runs and billing then attribute to the org, and the key survives individual member changes.