API keys

API keys are the secret keys that let your own servers and scripts reach your app's data. Each key is limited to the collections and what it may do with people that you give it. Create one for each job, see how it's been used, and revoke it when you no longer need it.

Steps

Overview

1. Open Settings, then API keys, to see the keys your servers use, and what each one may reach.

   

A new key

2. Choose New secret key and give it a name that says what it's for.

   

3. What it may do with people acts on a person instead of a collection. Each one is off until you tick it, and a key with one of them needs no collection.

   

4. Choose the collections it may reach, and whether it may write to them. A key reaches those collections, what it may do with people, and nothing else.

   

5. Review shows what the key will reach before it exists, with the two lines your server needs to use it.

   

6. Choose Create key and copy the key it shows. It is shown only once.

10. Continue is disabled until you pick at least one collection or turn on something it may do with people, so a key that reaches nothing can't be created.

    

One key

7. Open a key to see what it may reach and when it was last used.

   

8. Choose Show the last 7 days to see every call made with the key in that time.

   

9. Choose Rotate to issue a new key, which stops the old one at once, or Revoke to stop it for good.

Errors

• Give it a name you will recognise in the audit trail — two characters at least.

  The name is how you'll tell the key apart in Logs months later.

How server code uses a secret key: Keys & environments.