API Keys

Personal Access Tokens are managed from Settings → API Access inside the authenticated app.

Creating a key

Give it a name, choose scopes, and pick an expiry (never, 30, 90, or 365 days).

The full secret is shown once, immediately after creation. Copy it then — it cannot be retrieved again after you leave the screen.

Revoking a key

Revoke a key at any time from the same page; any integration using it immediately loses access. There is no one-click way to swap a key's secret today — create a new key, update your integration to use it, then revoke the old one.

Security recommendations

• Store the secret in a secrets manager, never in client-side code.
• Use a separate key per integration.
• Grant the narrowest scopes the integration needs.
• Revoke immediately if a key may have leaked.