Skip to content
LogoLogo

How to authenticate with an API key

This guide shows you how to authenticate a server-to-server integration. An API key gives access for a long time, inside a set of scopes.

1. Create the key

Only a user with a session can create a key. Another API key cannot.

mutation {
  apiKeyCreate(input: {
    organizationId: "org-id"
    name: "CI/CD Pipeline Key"
    projectId: "project-id"
    scopes: [ORGANIZATION_READ, ORGANIZATION_PROJECTS_READ]
  }) {
    apiKey
  }
}

The response holds the full key one time only. Keep it in a secure place.

The scopes that you ask for must all be scopes of the user who creates the key.

2. Send the key

x-api-key: pk_live_abc123...

3. Revoke the key

mutation {
  apiKeyRevoke(input: { keyId: "key-id", organizationId: "org-id" })
}