Skip to main content
API keys authenticate requests to the 1eye API. Each key belongs to a workspace and shares that workspace’s rate limits.

​
About API keys

1eye Production API keys begin with:
API keys are passed as Bearer tokens in the Authorization header:
The full value of a new API key is shown only once, immediately after creation. Copy and store it securely before leaving the page. After creation, the full key cannot be retrieved again. 1eye displays only a masked version:
An API key can be Active or Revoked. Active keys can be rotated or revoked. Once a key is revoked, it cannot be restored.

​
The API Keys table

The API Keys page shows the API keys associated with your workspace. For each key, you can view its name, status, masked API key, creation and update information, and available actions. You can also view API request activity for an individual key or across your workspace.

​
Create an API key

  1. Open your 1eye workspace and go to Developers → API Keys
  2. Select New API Key
  3. Enter a descriptive name, such as Production or Staging
  4. Create the key
  5. Copy the full API key and store it securely
The full key will not be shown again after you leave the creation screen.

​
Use an API key

Include your API key in the Authorization header of every request:
API keys must never be included in request URLs or passed as query parameters.

​
Rotate an API key

Rotate an API key when you need to replace its current secret, such as during routine credential rotation or if you believe the key may have been exposed.
  1. Go to Developers → API Keys
  2. Find the API key you want to rotate
  3. Select Rotate API Key
  4. Confirm the action
  5. Copy and securely store the new API key value
  6. Update your integration to use the new value
The new full API key value is shown only once. After rotation, make sure any applications or integrations using the previous key value are updated to use the new one.

​
Revoke an API key

Revoke an API key when it is no longer needed. Revoking a key prevents it from authenticating future API requests and cannot be undone.
  1. Go to Developers → API Keys
  2. Find the API key you want to revoke
  3. Select Revoke API Key
  4. Confirm the action
Before revoking a key that is still in use, update the affected integration to use another active API key to avoid interruption.

​
If you lose an API key

The full value of an API key cannot be retrieved after it has been shown. If you lose the key value, rotate the API key to generate a new value:
  1. Go to Developers → API Keys
  2. Find the affected key
  3. Select Rotate API Key
  4. Copy and securely store the new value
  5. Update your integration
If the key is no longer needed, revoke it instead.

​
Rate limits

Rate limits apply at the workspace level, not per API key. All API keys within the same workspace share the workspace’s request limits. Creating additional API keys does not increase API capacity.

​
Best practices

  • Use separate keys for separate environments — Create distinct keys for production, staging, testing, or individual integrations.
  • Use descriptive names — Names such as Production, Staging, or Data Warehouse make keys easier to identify and manage.
  • Store keys securely — Keep API keys in a secrets manager or environment variable instead of source code.
  • Never expose keys in client-side code — API keys should only be used from secure server-side environments.
  • Never share keys in plain text — Avoid sending API keys through chat, email, tickets, or other unsecured channels.
  • Rotate keys periodically — Rotate credentials according to your organization’s security practices.
  • Rotate exposed keys immediately — If a key may have been compromised, rotate it and update the affected integrations.
  • Revoke unused keys — Revoke credentials that are no longer needed.

​
Next step

Use API Logs to review requests made with your API keys and troubleshoot integration activity.