# API Keys

Create and manage API keys for programmatic access.

Source: https://statusdashboard.com/docs/security/api-keys

API keys authenticate calls to the [StatusDashboard REST API](/docs/api) from scripts, CI jobs, and integrations. Each user creates and manages their own keys; keys inherit that user's roles and act as the user, not as a separate service account.

Open [API Keys](/app/api-keys) from the user menu. Your plan must include the **API access** feature. The sections below cover creation, usage, rotation, and revocation.

***

## Who can use API keys
Platform API keys let you call the [StatusDashboard REST API](/docs/api) from scripts, CI pipelines, and integrations. Each user manages their own keys — keys are not shared across org members.

Any org member with the **API access** feature on their plan can create keys. All roles (Admin, Event, Subscriber) can manage their own keys when the feature is enabled.

Keys authenticate as **you** — with your user identity and live org roles — not as a separate service account.

## Creating a key
1. Open [API Keys](/app/api-keys) from the user menu (top-right avatar).
2. Click **Generate new API key**.
3. Optionally enter a label (for example, `Production CI`).
4. Copy the full key when it appears — it is shown **exactly once** and cannot be retrieved later.

Your plan limits how many keys each user may hold. The page shows `N of M keys used`.

> Store the full 
>   `keyId:secret`
>    string in a secrets manager immediately. If you close the dialog without saving, the secret is lost — revoke the key and create a new one.

## Using a key
See [API Basics](/docs/api) for the base URL, required headers, and status codes.

## Listing and revoking keys
* **In the admin console:** the API Keys page lists your keys with name, key ID, and created date. Use the trash icon to revoke a key.
* **Via API:** `GET /app/api-keys` lists metadata (never the secret). `DELETE /app/api-keys/{keyId}` revokes a key.

Both list and revoke work with an existing API key — useful for automation that audits or rotates credentials.

**Creating** a new key requires an interactive login (JWT from the web app), not an existing API key. This prevents a stolen key from minting additional keys.

## When keys stop working
A key returns **403 Forbidden** on the next request when:

* You revoke it from the API Keys page or API
* Your user account is removed from the organization (keys are revoked automatically)
* Your org loses the API access feature, your membership is disabled, or the org is suspended