Skip to main content

Personal API keys

Personal API keys let you generate keys that authenticate API requests as you. Use them to connect your own scripts, CLI tools, or external services to the platform outside the normal browser session. A personal key is not scoped to a single project or a single capability: anything it is used with can do anything your account can do.

Where to find it​

Settings → Account Settings → Personal API keys (/settings/account/api-keys).

How do I create a key?​

  1. Open the Personal API keys tab.
  2. Type a name for the key (for example "local CLI"). This is just a label to help you tell keys apart later, not a secret itself. Create key stays disabled until you type something (pressing Enter in the field also submits).
  3. Click Create key.
  4. Copy the token shown in the callout that appears; it is displayed only this once, right after creation.

There is no way to view a key's raw token again later. Only a hash of it is kept on the server, so if you lose it, the only option is to revoke it and create a new one.

Active personal keys​

Below the create form, Active personal keys lists every key you have not revoked, each showing its name and a masked prefix (the first few characters followed by •••) so you can recognize which is which without exposing the full token.

How do I revoke a key?​

  1. Find the key in Active personal keys and click Revoke.
  2. A confirmation dialog opens, warning that the key will stop working immediately and that anything using it (scripts, CI, integrations) will start failing.
  3. Click Revoke key to confirm, or Cancel / Esc to back out.

This cannot be undone: a revoked key cannot be reactivated, and the dialog is explicit that whatever currently relies on it breaks the moment you confirm.

How this connects to the rest of the platform​

  • It is personal, not project-scoped. For credentials that agents need to do project work (API keys for external services, tokens, and so on), that is the Secrets vault instead. See the Secrets guide. Do not hand a personal API key to an agent's secret slot; they solve different problems (you authenticating as yourself, versus an agent authenticating to a third party on the project's behalf).
  • It carries your full account access, not a reduced scope, so treat it with the same care as your password, and revoke it the moment a script or integration that used it is retired.
On this page