Create and scope API keys

Create workspace-owned keys with the least scopes required.

Create in the app

An authorized workspace member creates, labels and scopes an API key inside Settings. The secret is shown only through the configured app flow; store it in a server-side secret manager.

Scope and rotate

Grant only required scan, finding or other supported scopes. Revoke unused keys and rotate on suspected exposure. Never place a key in browser code.