API Keys
Create and manage API keys for programmatic access.
API keys authenticate calls to the StatusDashboard REST API from scripts, CI jobs, and integrations. Each user creates and manages their own keys; keys inherit that user's roles and act as the user, not as a separate service account.
Open API Keys from the user menu. Your plan must include the API access feature. The sections below cover creation, usage, rotation, and revocation.
Who can use API keys
Platform API keys let you call the StatusDashboard REST API from scripts, CI pipelines, and integrations. Each user manages their own keys — keys are not shared across org members.
Any org member with the API access feature on their plan can create keys. All roles (Admin, Event, Subscriber) can manage their own keys when the feature is enabled.
Keys authenticate as you — with your user identity and live org roles — not as a separate service account.
Creating a key
- Open API Keys from the user menu (top-right avatar).
- Click Generate new API key.
- Optionally enter a label (for example,
Production CI). - Copy the full key when it appears — it is shown exactly once and cannot be retrieved later.
Your plan limits how many keys each user may hold. The page shows N of M keys used.
keyId:secret string in a secrets manager immediately. If you close the dialog without saving, the secret is lost — revoke the key and create a new one.Using a key
See API Basics for the base URL, required headers, and status codes.
Listing and revoking keys
- In the admin console: the API Keys page lists your keys with name, key ID, and created date. Use the trash icon to revoke a key.
- Via API:
GET /app/api-keyslists metadata (never the secret).DELETE /app/api-keys/{keyId}revokes a key.
Both list and revoke work with an existing API key — useful for automation that audits or rotates credentials.
Creating a new key requires an interactive login (JWT from the web app), not an existing API key. This prevents a stolen key from minting additional keys.
When keys stop working
A key returns 403 Forbidden on the next request when:
- You revoke it from the API Keys page or API
- Your user account is removed from the organization (keys are revoked automatically)
- Your org loses the API access feature, your membership is disabled, or the org is suspended