Creating and rotating an API key
Make a key for each integration, limit what it can do, rotate it with a grace period, and revoke it.
Last updated September 17, 2026
On this page
Press New key.
Name it after the integration. Secret for a server, Publishable for a page (read-only, public tables only).
Read and write or read only; an expiry; the tables it may touch; optionally the addresses it may be used from.
The key is shown a single time. If you lose it, make a new one.
Rotating
Rotate gives you a replacement and lets the old key keep working for a grace period you choose, so every integration can be switched over without a gap. Choose no grace period if the key leaked.
Revoking
Revoke a key and every call with it is refused from that moment.
Before the app is published
Keys you make before publishing keep working; the endpoints answer the moment you publish.
Developers: see the API documentation.