Create and revoke read-only API keys

Where: Admin → System → Security → API keys

Before you start

This API is read-only and follows public content visibility. A lost secret cannot be displayed again; create a replacement. A query-string key is offered for constrained clients but can be retained in logs/history, so prefer the header. Endpoint URLs on the page match the running board.

Step by step

1. Read the endpoint/scope list shown by the screen.
2. Enter What it is for, select only the scopes your integration needs, and Create key.
3. Copy the secret immediately into the integration’s secure storage; the board stores only its hash.
4. Send it in X-Api-Key where the client supports headers.
5. Revoke a compromised/unused key; Restore only if you intentionally want the previously held key active again.

Settings and behaviour

This API is read-only and follows public content visibility. A lost secret cannot be displayed again; create a replacement. A query-string key is offered for constrained clients but can be retained in logs/history, so prefer the header. Endpoint URLs on the page match the running board.

Check the result

Test an allowed endpoint and confirm a revoked key is refused. Verify restricted-category content is excluded.

Common questions and troubleshooting

Key lost: replacement is required, not Restore. Endpoint denied: inspect scopes and revocation. Need content writes: this read-only API does not promise posting/admin mutation.