API keys
The API Keys tab on the Secrets page lists managed API keys: credential records that the API Key (provider) authentication method checks a presented key against. Each record carries its own status, rotation history, and issuer. For a single credential held as a plain value, see Secrets.
API key record fields
The API Keys list shows Client ID, Key ID, Surface, Status, and Created for each key. Selecting a key opens its detail page, with the remaining fields under Metadata.
| Field | Default | Description |
|---|---|---|
| Key ID | Generated automatically | Unique identifier, prefixed atgk_. |
| Client ID | — | External client identifier associated with the key. |
| Surface | — | The surface the key belongs to. Shown as Surface in the API Keys list and as Channel on the key detail page. |
| Status | Active | Active or Revoked. See Status values. |
| Created | — | When the key was issued. |
| Revoked | Not set | When the key was revoked. |
| Last Used | Not set | When the key last authenticated a request. Updated on a best-effort basis, so it can lag under concurrent use. |
| Issuer | — | Who issued the key and how, for example by rotation. |
| Rotated From | None | The Key ID of the key this one replaced, when the key was issued by rotation. |
A key’s secret, prefixed atgs_, is shown only once, when the key is issued or rotated. It can’t be retrieved later.
Status values
| Status | Meaning |
|---|---|
| Active | Can authenticate. |
| Revoked | Can’t authenticate. Revocation is permanent. |
A Rotate required badge beside Active marks a key with no usable secret. The key can’t authenticate until it is rotated, which issues a new secret.
Rotation, revocation, and deletion
Each Active key has Revoke and Rotate actions, in the API Keys list and on its detail page. Any key can be deleted.
- Rotate revokes the key immediately and issues a replacement with a new Key ID and secret. The replacement keeps the same Client ID and Surface, and names the old key in Rotated From.
- Revoke stops a key authenticating and keeps its record, so a revoked key can’t be rotated.
- Delete removes the record entirely.
Related
- Source authentication: every caller-authentication method a surface supports, and the identity each produces.
- Secrets: the credential store behind the API Key (secret store) method.
- RBAC: the permissions that gate this tab, Administrator-only by default.
- Security and access control: the conceptual model for source authentication and credentials.
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.