-
Notifications
You must be signed in to change notification settings - Fork 0
API Keys
Programmatic access for CI/CD and automation, as an alternative to the cookie-based session used by the web dashboard.
Send it in either header:
X-API-Key: mp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
or
Authorization: Bearer mp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Keys are stored hashed (never in plaintext) — the raw key is only shown once, at creation time.
- Org **
viewer**s cannot create, list, or revoke API keys (403 Viewers are not permitted to manage API Keys). - A key inherits the permissions of the user who created it, resolved the same way as RBAC and Permissions describes for any other request — it is not a separate permission model.
Every key has a scope, set at creation time:
| Scope | Behavior |
|---|---|
full (default) |
Can make any request the underlying user's role permits. |
read-only |
Restricted to GET requests only, regardless of the user's role. Any non-GET request with a read-only key gets 403 API key has read-only access — enforced centrally in the auth middleware, before it reaches any route handler. |
Use read-only for anything that should never be able to mutate secrets even if the key leaks — e.g. a monitoring/export job that only reads values.
Set an expiry when creating a key. Once expiresAt is in the past, every request with that key gets 401 API key has expired. Keys without an expiry never expire on their own — revoke unused ones manually.
Each key has a rateLimit (requests per rolling 60-second window), defaulting to 60 requests/minute. Set it to 0 to disable rate limiting for that key. Once the limit is hit, the server returns 429 Too many requests. Rate limit exceeded. until the window resets.
The limiter tracks usage in-memory per server process — in a multi-instance deployment, each instance enforces the limit independently rather than sharing a global counter.
Every authenticated request via a key updates requestCount and lastUsedAt on that key (applied asynchronously, so it doesn't add latency to the request). Useful for spotting stale keys that should be revoked.