Drıftstack docs
Docs

Create, rotate and revoke API keys

You might be here because: “how do I get an API key” · “where is my API key” · “I lost my API key” · “The full key is shown only once” · “Key created — copy it now” · “rotate my key” · “Old key valid until” · “revoke a leaked key” · “New key button is greyed out” · “can I create a key from the desktop app or from a script” · “what permission should a key have”

Short answer

Keys are made on the dashboard’s API keys page: press New key, name it, pick a permission, and copy the key from “Key created — copy it now” — it is shown only once. A lost key cannot be recovered, not even by support: rotate it, or revoke it and create a new one.

Check first

  • Plan includes the API? Every current plan and the Trial do; only the earlier Free plan could not create keys (see Related).
  • Owner accepted every legal document and every new version that needs acceptance? Until then creating and rotating are refused (see Related).
  • Acting as a team owner with the member role? The owner’s keys are not listed for a member, and only an admin can create, rotate or revoke them: “Ask a team admin to create, rotate, or revoke keys.”.
  • In a browser, signed in? Creating and rotating are dashboard-only: an API key cannot mint or rotate another, so a leaked key cannot keep itself alive.

Likely causes and fixes

  1. Create. Name keys by purpose or environment, such as “production-server” (1–120 characters); one key per environment is usual, each with its own permissions, so a leaked one can be revoked alone. Permissions: account_owner — full access, including webhooks, billing and other keys; write — create and control sessions, nothing else; read — view only; granular — exactly the boxes you tick. Send it as the bearer token on every request.

  2. Rotate. Press Rotate on the key: “API key rotated” shows the new key once, and “Old key valid until” gives the time the old one stops — 24 hours later. Update everything that uses the old key before then, or those requests will be rejected. You can rename the key while rotating.

  3. Revoke. Takes effect immediately; the row shows “revoked” with the date, and requests with that key get a 401.

  4. Expiry. A key created through the API can carry an expiry date; the list shows “expires …” and the key stops after it. The dashboard form has no expiry field.

  5. New key is greyed out. “Your API keys need to load before you can create one.” — wait or reload. “Creating keys needs a plan with API access and permission to change this account.” — plan gate or team role.

  6. Matching a row to the key in your code. The list shows each key’s prefix. Only a one-way hash of the key is stored, so staff cannot read it.

If it still fails

Press Talk to a person in this chat (or open Help) and include: account email, the key’s name and prefix (never the full key), and the exact sentence the page showed.