Overview
API keys authenticate your scripts and integrations against the ObservePoint API. Instead of one key per person, you can now create a separate named key for each thing that uses the API: a CI job, a partner script, a reporting pull, an AI or MCP integration.
Giving each integration its own key means you can replace one of them without touching the others, set an expiration date on the ones that shouldn't live forever, and see when each was last used before you decide to remove it.
Every key acts as a specific user and has exactly that person's permissions. Admins can create keys on behalf of anyone in their account and see every key across the account.
Who can use it
Role | What they can do |
Admin | Create, view, and manage every key in the account. Choose which user a key acts as. |
Standard user | Create, view, and manage their own keys. Their keys always act as themselves. |
Read-only user | Read data from assigned Folders if an API Key is assigned. |
How to Access
Click the settings gear in the top navigation bar.
Select API Keys.
You can also get there from your profile: open My Profile and use the Manage keys link on the API Access card.
Admins see two tabs on the page:
My Keys: keys that act as you
All Keys: every key in the account
Standard users see only their own keys, with no tabs.
How to Use
Create a key
On the API Keys page, click Create key.
Enter a name. Use something that identifies what will use the key, like github-actions-deploy or weekly-tag-report. Names can be 3 to 64 characters and may contain letters, numbers, hyphens, and underscores. No spaces.
Optionally add a description (up to 280 characters). This is worth filling in. Six months from now it's the only thing that will tell you what a key was for.
If you're an admin, choose the user the key acts as. The key will have exactly that person's permissions. Standard users skip this step, since their keys always act as themselves.
Choose an expiration: 30, 60, or 90 days, 1 year, a custom date up to a year out, or No expiration.
Click Create.
Save the key now. The next screen shows your key, and it's the only time you'll ever see it. Click Copy to put it on your clipboard, or Download to save it as a text file that includes the key's name, description, acting user, and expiration. Then tick the acknowledgement box and click Done.
If you close that dialog without saving the key, the value is gone for good. You'll need to regenerate the key to get a new one.
Understand key status
Each key shows a status based on its expiration date:
Active (green): more than 14 days until expiration, or no expiration set
Expiring soon (orange): 14 days or fewer remaining, with a day count
Expired (red): past its expiration date and no longer working
Each row also shows who created the key and when, which user it acts as, when it expires, and when it was last used. "Last used" is accurate to within about 15 minutes.
Rotate a key
Use Regenerate when the integration still exists and just needs a new secret.
Click the 3-dot menu on the key's row and choose Regenerate.
Confirm.
Copy or download the new key, then click Done.
The key keeps its name, description, acting user, and expiration. Only the secret changes.
The old secret stops working immediately. Anything still using it starts failing right away, so update your integration as soon as you regenerate.
Rename or edit a key
Click the 3-dot menu on the key's row and choose Rename.
Update the name and description. Admins can also change which user the key acts as.
Save.
Editing never changes the secret or the expiration date. If you're an admin changing the acting user, keep in mind that the key's permissions change to match the new user.
Revoke a key
Revoking permanently disables a key. Anything using it stops working immediately.
Click the 3-dot menu on the key's row and choose Revoke key.
Confirm.
Check the last used time before you revoke. If a key was used recently, something is still depending on it.
For keys that have already expired, the menu offers Remove instead, which clears the row from your list.
Expiration reminders
If a key has an expiration date, we email the user it acts as:
Every Sunday, a summary of their keys expiring in the next 14 days
The day before a key expires
Each email lists the key name, description, a partial version of the key so you can match it against your integration, and the expiration date, with a link straight to this page.
Keys set to No expiration never generate these emails.
Best Practices
One key per integration. Separate keys for CI, reporting, and any partner scripts. That's what makes it possible to change one without breaking the rest.
Name keys after what uses them, not after yourself. jenkins-nightly-audit tells you something useful. my-key doesn't.
Fill in the description. It's the fastest way to answer "can I safely delete this?" later.
Set an expiration when you reasonably can. "No expiration" is available and is pre-selected, but a credential that never expires is one you'll never be prompted to review. Reserve it for integrations that genuinely can't tolerate a rotation window.
Check "last used" before revoking. A recent timestamp means something still depends on that key.
Store keys in a secrets manager, not in a spreadsheet, a Slack message, or your code.
Rotate before off-boarding. If someone is leaving, re-point or replace their keys first. Deactivating a user kills their keys instantly.
Clean up periodically. Revoke keys for integrations you've retired. A key nobody is watching is a key nobody will notice being misused.
Common Questions
What happened to my old API key?
It still works. It appears in your list as Legacy API-Key and doesn't expire.
However, you can no longer copy it from ObservePoint. The value on your My Profile page has been removed, and stored key values are now partially hidden. If you didn't save your key somewhere, create a new key and switch your integration over to it.
Why can't I see a key after I create it?
Keys are shown once, at the moment you create or regenerate them. After that, ObservePoint has no way to display the value again. This is how most API platforms handle credentials, and it means a working secret isn't sitting readable in your account indefinitely.
If you lose a key, regenerate it and update whatever was using it.
What's the difference between Regenerate and Revoke?
Regenerate gives an existing key a new secret while keeping its name, description, acting user, and expiration. Use it when the integration still exists.
Revoke permanently disables the key and removes it. Use it when the integration is gone.
Whose permissions does a key have?
The permissions of the user it acts as, kept current. If that person's role changes, the key's access changes with it. A key can never do more than the person it acts as.
Can I create a key for someone else?
Admins can. Choose the acting user when creating the key, or change it later by editing the key. Standard users can only create keys that act as themselves.
What happens to keys when someone leaves the company?
When a user is deactivated, every key acting as them stops working immediately. Before confirming a deactivation, an admin sees which keys will be affected and when each was last used, so anything important can be re-pointed to another user first.
How many keys can I have?
Up to 50 active or expiring keys per user. Expired keys don't count toward that limit.
Do I have to set an expiration date?
No. No expiration is an option and is pre-selected. Dated keys can be set up to one year out. We'd encourage an expiration on anything that isn't genuinely permanent.
How accurate is "Last used"?
Within roughly 15 minutes. It's recorded in the background so it never slows down your API calls. Only successful authentications update it.
Related
Complete API documentation: https://api-docs.observepoint.com/
Need Help?
Contact your Customer Success Manager or reach out to ObservePoint support.