Cloud/Settings/API Keys
API Keys
Programmatic access to the organization: keys scoped to exactly the permissions they need, with optional expiry, rotation and revocation.
API Keys is the machine door into the organization's resources. The description: "Programmatic access to this organization's resources." Reading the page requires org:settings:read.
API Keys
Programmatic access to this organization's resources.
vok_live_••••••••7c2eCreated Apr 2025Last used 2 hours agovok_live_••••••••b81dCreated Aug 2025Last used 6 days agoCreate API key
Scope the key to only the permissions it needs.
The mockup is the real page. Revoke a key and watch it leave the list; the create form shows how a key is scoped at birth.
One key, one job
Each key shows its name, its masked value, when it was created and when it was last used. That last-used line is the quiet feature: it tells you which keys are alive and which are stale candidates for revocation. Two actions sit on every row: Rotate replaces the secret, and Revoke kills the key outright, with confirmation, because everything calling it stops on the spot.
Creating a scoped key
Create API key keeps the principle from the connector tabs, least privilege: "Scope the key to only the permissions it needs." You name the key, pick a subset of the organization's permission catalog, and optionally set an expiry. A reporting script gets org:audit:read, nothing more. The full secret appears once at creation, in the console's show-once idiom, and only the masked form lives on the page afterwards.
Why this page exists
Integrations need credentials, and person accounts are the wrong home for them. Organization-scoped keys carry their own permissions and their own expiry, so access is measured out instead of shared. When a key's job ends, Revoke ends it too; when a key's secret may have leaked, Rotate ends the old value without touching the configuration.
What comes next
Audit Log records every security-relevant event these keys and the humans around them produce.