Skip to main content

​
API Keys

API keys are service-principal credentials for customer-owned automation. API key management endpoints require a user subject. A token that is itself an API key cannot create, reveal, list, or delete API keys.

​
Management Flow

  1. Authenticate with a user JWT.
  2. POST /integrations/api-keys to create a key.
  3. Store the returned key immediately. It is secret material.
  4. Use Authorization: Bearer bzy_live_... for server-to-server requests.
  5. Rotate and delete unused keys with the management endpoints.

​
Safety Expectations

  • Store keys only in secret managers or equivalent encrypted configuration.
  • Do not log full key values.
  • Prefer one key per integration or automation owner.
  • Delete keys immediately when an integration is retired.
See: packages/backend/src/orpc/router/api-keys.ts