API keys
Create, manage, and rotate the keys that authenticate SDK and API calls.
Last updated
Create, manage, and rotate the keys that authenticate SDK and API calls.
API keys authenticate server-to-server SDK and REST calls. Every operation performed with a key is scoped to the organization that key belongs to. For how to send the key on a request, see Authentication.
Go to Settings → API keys in the admin panel.
Click Create API key and enter a name.
Copy the key immediately. Production keys are shown only once.
The environment is inferred from the organization. Production organizations create production keys, and sandbox organizations create sandbox keys.
Keys must be created here. A key minted outside the admin panel has no organization link and is rejected by SDK and API endpoints. The link is what scopes the key to your data.
From the API keys page you can view each key's name, prefix, environment, status, and last-used date, and you can view a key's details and either revoke (disable) or permanently delete the key.
Keys are rate-limited with a daily request window by default. Contact Motif to adjust production limits.
Never expose keys in client-side code. They are organization-wide secrets. For browsers, use an embed token.
Store keys in a secrets manager or environment variables.
Rotate by creating a replacement key, updating your backend, then disabling the old one.
Use sandbox organizations for development and automated tests.
Key creation and revocation are captured in the audit log.
Last updated