Skip to main content

Managing API keys

note

Tier: Starter, Professional, Enterprise

API keys authenticate requests to the Public API. Each key belongs to the user who created it and carries that user's permissions. A request made with your key can access exactly the records you can access in the app.

Generate a new key​

  1. In the Passwd web app, open your profile menu in the left sidebar and select API keys.
  2. Click Generate new key.
  3. Give the key a descriptive name, for example the system that will use it (CI pipeline, Terraform).
  4. Copy the key.
warning

The full key is shown only once, right after it is created. Passwd stores only a hash of the key, so it cannot be displayed again. If you lose a key, revoke it and generate a new one.

Inspect your keys​

The API Keys section lists all your keys with:

  • Name: the label you chose when creating the key.
  • Key: a masked preview showing only the last 4 characters.
  • Created: when the key was generated.
  • Last used: when the key last authenticated a successful API request. Never means the key has not been used yet, which helps you spot keys that can be revoked.

Revoke a key​

Delete the key in the API Keys section. Revocation is immediate: the next request with that key gets 401 Unauthorized. Revoking a key does not affect any records it created.

Keys are also revoked automatically: they are tied to your user account and stop working when the account is removed from your Google Workspace.

Keep your keys safe​

Treat an API key like a password:

  • Store keys in a secret manager (Google Secret Manager, CI/CD variables), never in source code or config files committed to a repository.
  • Create a separate key per integration, so you can revoke one system's access without breaking the others.
  • Revoke keys you no longer use; the Last used column helps you find them.