API keys
The API Keys tab on the Secrets page lists managed API keys: credential records that the API Key (provider) authentication method checks a presented key against. Each record carries its own status, rotation history, and issuer. For a single credential held as a plain value, see Secrets.
API key record fields
The API Keys list shows Client ID, Key ID, Surface, Status, and Created for each key. Selecting a key opens its detail page, with the remaining fields under Metadata.
| Field | Default | Description |
|---|---|---|
| Key ID | Generated automatically | Unique identifier, prefixed atgk_. |
| Client ID | — | External client identifier associated with the key. |
| Surface | — | The surface the key belongs to. Shown as Surface in the API Keys list and as Channel on the key detail page. |
| Status | Active | Active or Revoked. See Status values. |
| Created | — | When the key was issued. |
| Revoked | Not set | When the key was revoked. |
| Last Used | Not set | When the key last authenticated a request. Updated on a best-effort basis, so it can lag under concurrent use. |
| Issuer | — | Who issued the key and how, for example by rotation. |
| Rotated From | None | The Key ID of the key this one replaced, when the key was issued by rotation. |
A key’s secret, prefixed atgs_, is shown only once, when the key is issued or rotated. It can’t be retrieved later.
Status values
| Status | Meaning |
|---|---|
| Active | Can authenticate. |
| Revoked | Can’t authenticate. Revocation is permanent. |
A Rotate required badge beside Active marks a key with no usable secret. The key can’t authenticate until it is rotated, which issues a new secret.
Rotation, revocation, and deletion
Each Active key has Revoke and Rotate actions, in the API Keys list and on its detail page. Any key can be deleted.
- Rotate revokes the key immediately and issues a replacement with a new Key ID and secret. The replacement keeps the same Client ID and Surface, and names the old key in Rotated From.
- Revoke stops a key authenticating and keeps its record, so a revoked key can’t be rotated.
- Delete removes the record entirely.
Related
- Source authentication: every caller-authentication method a surface supports, and the identity each produces.
- Secrets: the credential store behind the API Key (secret store) method.
- RBAC: the permissions that gate this tab, Administrator-only by default.
- Security and access control: the conceptual model for source authentication and credentials.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.