Create and revoke API keys

Create a key

1. Open API Keys.
2. Select Create key.
3. Enter a descriptive Name and choose when the key should expire.
4. Keep Restrict key enabled and select only the endpoint permissions the integration needs. Write access includes read access for the same API area.
5. If requests must come from known addresses, enable Restrict by IP address and add the permitted IP addresses or CIDR ranges.
6. Select Create key.

Copy the secret from the API Key dialog before closing it. Threetone does not display that secret again. Store it in a server-side secret manager or environment variable, and never commit it to source control or expose it in browser code.

User API keys belong to the creating account. Use the Service Accounts area when a credential must be owned by the workspace instead of one user.

Revoke a key

On the API keys page, select the revoke action for the key, review its name and masked value, then select Revoke key. Revocation cannot be undone, and requests using that key fail immediately.

Update every service that used the key. Remove the revoked value from secret stores, deployment settings, and local development environments.