API Key Management (Web App)
This documents the in-app API keys interface at /{workspace}/services/{id}/api-keys. For using keys in requests and SDKs, see API Keys.
The web app’s API key interface is intentionally minimal: keys are created with a name only. There is no scope selection, no permission level (read/write/admin), and no expiration in this UI. Sections describing scopes/permissions/expiration elsewhere in the docs do not reflect what the app exposes today — see the flag on issue #7.
Layout
The page shows a header (API Keys + a Create Key button) and an Active Keys card listing the service’s keys. While loading, a spinner is shown; with no keys, an empty state prompts Create your first API key to get started.
Creating a key
- Click Create Key.
- Enter a name (e.g.
Production API Key) — this is the only field. - On creation, the full secret is shown once in an “API Key Created” dialog: “Copy your API key now. You won’t be able to see it again!” Copy it before closing.
Keys are apso_-prefixed secret strings.
The full key is revealed only at creation. After that the list shows a masked value (apso_ prefix + a few characters, the rest hidden). Store it in a secret manager immediately — it cannot be retrieved in full later.
Listing keys
Each key in the Active Keys list shows:
- Name
- Status badge (
Active) - Masked secret with a show/hide toggle (eye icon) and a copy button
- A ⋮ actions menu
Key actions
| Action | Effect |
|---|---|
| Show / hide | Toggles the masked secret display (masked value only; the full secret is not re-revealed) |
| Copy | Copies the key value to the clipboard |
| Deactivate | Sets the key’s status to Deactivated (reversible state change, keeps the record) |
| Revoke | Permanently revokes the key (destructive) |
Key statuses are Active and Deactivated; Revoke removes the key. There is no separate “delete” distinct from revoke, and no “view full key” after creation.
Not in this interface
The following, requested in the component checklist, are not implemented in the web app API keys view:
- Access scopes and permission levels (read / write / admin) — creation is name-only.
- Usage tracking — call counts, rate limits, usage graphs, alerts, reports, and billing implications are not shown on this page.
- Expiration — no expiry can be set in the app.
Related
- API Keys — using keys in requests and SDKs
- Service Settings