Generate a token

Creating a personal API key requires a paid plan (Solo or Professional) or unused credits from a credit pack. The monthly credits of a Free account don't count.

For organization work, create an integration under Organizations → API integrations instead. Its service keys have explicit spaces, permissions, expiry and a credit ceiling; see Scoped service API.

How do I create and save a key?

Open your account profile to manage personal API keys. Give each key a name that identifies its use, such as “Alert receiver” or “CI research”. You can keep five active keys per account. Expired and revoked keys do not count toward this limit.

Choose an expiration of 1–365 days, or leave the key without an expiration. Creating or rotating a key requires authentication within the last five minutes. Confirm your identity again when prompted.

The full secret appears only in the creation or rotation response. Copy it immediately to your password manager or the secret store used by your integration. After that, the profile shows identifying metadata such as its name, display hint, expiration and last use. You cannot retrieve the secret again. If you lose it, create a replacement or rotate the key and save the new secret.

New keys use the format pk_<12-character id>_<43-character secret>. Existing 64-character keys keep working until they expire or are revoked. You do not need to replace an existing key just because its format is older.

Your key lets an integration use the API or receive your configured alerts. Anyone holding it can use your account's available API access and credits.

How do I rotate a key without stopping an integration?

Rotate the key used by that integration. Rotation creates a new secret with the same name and, by default, the same expiration as the old key.

• With the default zero-hour overlap, the old key stops working immediately. This replacement works even when you already have five active keys.
• With an overlap of 1–24 hours, both keys work while you update the integration. The old key stops working when the overlap ends, or at its existing expiration if that comes first.
• During an overlap, both keys count toward the five-key limit. You need a free slot before starting a rotation with overlap.

Save the new secret, update your integration and verify that it can authenticate. Rotating one key leaves your other keys unchanged. If a key has leaked, revoke it or rotate it with zero overlap so the old credential stops working immediately.

Can an administrator recover a lost key?

No. Stored credentials cannot be retrieved from the profile or the platform administrator's user view. If a platform administrator regenerates a key, that action produces a new secret shown once. It does not recover the previous secret.

What changes for older integrations?

Send personal keys in X-API-KEY or Authorization: Bearer, as shown in API usage. The ?api_key= URL parameter has a 90-day transition period starting when that deployment migrates to keys v2. There is no universal cutoff date: during that period, responses using the parameter include Deprecation and Sunset headers. The Sunset header gives the deployment's cutoff. After it, keys in the URL no longer authenticate; the same valid key can still be sent in a supported header.

For older account-management clients, createOrRenew rotates the newest active key with zero overlap, or creates a key named “Default” if none is active. It requires the same recent authentication. The legacy delete action revokes all personal keys; use the individual key's revoke action when you only intend to stop one integration.