The job of this console
Issue a key for a named app, copy the secret immediately, then revoke when the partner rotates or leaves. Never paste keys into tickets or Work Graph comments.
Admin · Extensibility
API Keys
Issue, export metadata, and revoke integration keys. Secret material is shown once.
Scroll to Flowcharts. Scenario: Issue and revoke an API key.
Integration credentials
Issue, copy once, revoke without ceremony
API keys are integration credentials. Secret material is shown once. Metadata — name, last used, status — is what you export and audit.
Admin → Developer portal → API keys
Route
/admin/api-keys
Org flag apiKeysEnabled
HR Admin · Org Admin · integration owner
Seat at the table
The same administrators who own the developer portal. Engineers outside Admin should request a key, not share an existing one.
The working rhythm
Open keys, issue, copy, confirm the partner can call, then close the reveal. Revoke on incident. Export metadata for change control, not the secret.
Moments that bring you here
New integration. Scheduled rotation. A key seen in a screenshot. After an employee who held the secret leaves.
ⓘ
Metadata only after the first reveal
Audit and export never include the raw secret. Treat a lost secret as compromised — revoke rather than search logs.
Flowcharts
1 — Issue a key
Create a key, copy the secret once, then store it in the secret manager.
flowchart TD
A[Open API keys] --> B[Create key]
B --> C[Copy secret once]
C --> D[Store in vault]
D --> E[Use from integration]
E --> F[Revoke when done]
- 1Open API keysDeveloper hub → API keys.
- 2CreateName, app, and expiry.
- 3Copy onceThe secret is not shown again.
- 4RevokeImmediately on leak or owner change.
Overview
Keys authenticate against existing v2 APIs. They are not a second permission model — RBAC and persona masking still apply.
How to use
1. Never commit secrets
Docs and tickets get the key id only.
2. Export is metadata
CSV does not include secrets.
3. Short expiry for pilots
Rotate before go-live.