API keys
Create and manage machine API keys for integrations that call Automate without a human session.
API keys let external systems call Automate as a machine client. Use them for trusted integrations, backend jobs, and scripts that need stable access without a browser login.
Open Admin Panel → API Keys.
When to create an API key
Create an API key when:
- A backend service needs to call Automate.
- A script or scheduled job runs outside Automate.
- A trusted integration cannot use a human browser session.
Do not create API keys for casual testing when a normal user session is enough.
Create a key
Open API Keys
In Admin Panel, go to Authentication → API Keys.
API Keys under Authentication is for machine clients and trusted integrations. Create the key
Create a new key with a name that identifies the system using it, not the person creating it.
Store the secret
Copy the secret once and store it in your approved secrets manager. Do not paste it into the docs or source code.
Test from the integration
Test the key with the target system, then remove any temporary copies.
Naming and ownership
Good API key names answer three questions:
- Which system uses this key?
- Which environment is it for?
- Who owns it?
Examples:
billing-sync-productionclient-portal-stagingdata-export-nightly
Rotation and cleanup
Review API keys regularly:
| Event | Action |
|---|---|
| Owner leaves | Rotate or delete keys they maintained |
| Integration is retired | Delete the key |
| Key may have leaked | Revoke immediately and create a replacement |
| Environment changes | Create separate keys for staging and production |