Console and accounts
API keys in the console
Create, limit, inspect and revoke API keys from the console.
API keys authenticate calls to the data API. Manage them under API keys in an account (app.aggre.org/{handle}/keys). How a key is sent is in Authentication.
Creating a key#
Choose a name (1 to 80 characters), optionally a quota and its period, an IP allowlist and an expiry. The secret appears once in the confirmation; copy it then. Afterwards the list shows only the name, the 8-character prefix, the limits, last used, and the usage of the current period.
| Option | Notes |
|---|---|
| Name | Shown in the list, the usage page and the audit log. |
| Quota and period | day, month or total. The default is a monthly allowance shown on the form. You can lower it. |
| IP allowlist | CIDR ranges the key may be used from. Empty means any address. |
| Expiry | The key stops working at this time. |
Self-service limits: the quota cannot exceed the default allowance (a daily quota counts as up to 31 times its limit against it), it cannot be unlimited, the rate policy is default, and an account holds at most 20 active keys. Higher limits and unlimited keys are set by platform staff.
Who can manage keys#
On your personal account you do. In an organization, owners and admins create, edit and revoke keys; members can see them. Every creation and revocation is written to the audit log (Usage and audit log).
Revoking#
Revoke from the list. The key stops working within about 30 seconds. Revocation cannot be undone; create a new key instead.
Good practice#
- One key per application or environment, named for it, so usage and revocation are precise.
- Prefer an IP allowlist for servers with fixed addresses.
- Store keys in a secret manager, not in source control. If a key leaks, create a new one, deploy it, then revoke the old one.
- The console itself reads data for the data browser with a short-lived key of its own, created under your personal account. It is listed with your keys (named "Console browsing"), lasts 24 hours and is revoked when you sign out; it is not meant for your code.
Source: content/console/api-keys.md