Skip to content

API keys

Scoped, project-bound credentials for machines.

View as Markdown

One key, one project, explicit scopes

A key cannot reach across projects. Grant only the scopes the integration uses: db.query.read, db.query.write, blob.read, blob.write, app.read, function.read and the rest.

One key per integration

Separate keys mean you can revoke one without breaking the others, and the audit log attributes each change to the system that made it.

Where a key must never go

A key in a browser bundle is a published secret. Browser clients get short-lived tickets instead. In CI, keep the key in the secret store and never pass it as a public build argument.

Billing gates writes

An inactive managed subscription blocks platform mutations, including through API keys and the CLI. Sign-in and read access remain available so you can resolve the billing problem.