API keys and request authentication
Workspace-scoped keys and how to handle them safely.
Updated October 2026 · 1 min read
API keys are scoped to a workspace. A key can act only inside the workspace it was issued for.
Handle keys as secrets
- Never commit keys to a repository or paste them into chat or tickets.
- Keep keys in your secret manager or environment variables.
- Use a separate key for each environment.
- Remove a key as soon as it is no longer needed or may have leaked.
Requests without valid credentials are rejected. The API reference on the main site lists the endpoints and the request format.