Create an API Key

Choose the key owner before you begin:

• Use a personal API key for your own CLI, development tool, or script when requests should follow your current access.
• Use a service-account API key for a shared integration, production service, CI/CD job, or unattended workload.

Create a Personal API Key

1. Switch to the organisation the key should access.
2. Open the user menu and select API keys.
3. Enter a key name and optional expiry.
4. Select Create key.
5. Copy the displayed value immediately to a server-side secret manager. It is shown only once.

The key follows your current membership level, roles, groups, direct grants, status, and organisation membership. It does not have separate permissions.

Create and Authorise a Service Account

1. Open Access > Service accounts.
2. Select Create service account.
3. Enter a display name and canonical name that identify the workload and environment.
4. Add an optional purpose and account expiry, then select Create.
5. Open the account's Access tab.
6. Assign the narrowest compatible role or add it to a suitable group.
7. Review Effective permissions to confirm the account has only the intended access.
8. Open API keys.
9. Enter a key name and optional expiry, then select Issue key.
10. Copy the displayed value immediately to a server-side secret manager. It is shown only once.

The service account starts with no access and no credentials. Every key later issued for it authenticates as the same account and receives its current access.

Use and Rotate the Key

Use token exchange for normal API calls so the long-lived API key remains in secret storage:

POST /iam/auth/token
Content-Type: application/json

Send the returned short-lived token as Authorization: Bearer <accessToken>.

Rotate a key by issuing a replacement for the same owner, deploying the replacement, confirming it works, and then revoking the old key.

See API Keys for credential guidance.