API keys
An API key is a long-lived secret that authenticates requests for a principal. Send it in the x-api-key header. What the key can do follows the policies for that principal—not a separate per-key ACL beyond which principal it belongs to.
Create separate keys for each app or environment (publisher, browser subscriber, staging, production) so you can rotate or delete one without touching the others. Keep privileged keys in trusted servers; use narrowly scoped principals (and tokens when you need short sessions) for browsers and other untrusted clients.
Your first key usually comes from the Welcome page after registration—see Account and credentials.
Create, list, and delete#
Create (named key) → save secret once → use in x-api-key → list by name → delete to revoke
- Create returns the secret
apiKey—store it immediately; list later shows names, not secrets. - List pages key names for a principal (optional glob
pattern). - Delete removes a key by name so it can no longer authenticate (204, no body).
Plan rotation: issue a replacement, update dependents, then delete the old key.
When to use these endpoints#
- Issue a key for a new service, environment, or principal
- Inventory names when rotating or cleaning up credentials
- Delete a key after rotation, offboarding, or a suspected leak