Generating and Rotating API Keys

Creating an API key

Navigate to Workspace Settings > API Access and select “New API key.” Give the key a descriptive name indicating its purpose, for example “Marketing automation integration,” so it is identifiable later.

Scoping permissions

Each API key can be scoped to specific permissions: read-only access to assets, generation access for specific studios, or full workspace access. Scope keys as narrowly as possible for the integration they support.

Rotating a key safely

To rotate a key without downtime, create a new key with the same scope, update your integration to use the new key, confirm the integration is working correctly, then revoke the old key from Workspace Settings > API Access.

Revoking a compromised key

If a key is exposed or compromised, revoke it immediately from Workspace Settings > API Access. Revocation takes effect within seconds, and all requests using the revoked key will begin returning a 401 error.

Monitoring API key usage

View recent request activity per key, including request volume and error rates, under Workspace Settings > API Access > Usage, useful for identifying unused keys that can be safely revoked.