Developer API keys

Settings, section Developer API keys (/app/settings#developer). Owners and admins only. A key lets your own software call the OmniBrand public API with the header Authorization: Bearer ob_live_…

Step by step: create a key

1. Type a name in Key name (e.g. CI bot), up to 60 characters, so you know later what uses it.
2. Choose read only (reading data) or read + write (also creating and changing things).
3. Click Create key.
4. A yellow box shows "API key (copy now - shown only once):" and the full key. Copy it now and keep it somewhere safe; OmniBrand stores only a fingerprint and can never show it again.

The list

Each key shows its name, the first characters (ob_live_…), its scope, when it was last used ("used ..." or "never used") and "expires ..." with its end date. - Rotate: issues a new key with the same name and scope and shows it once. The old key keeps working for 24 hours so you can switch your integration over, then stops. Until then it stays in the list, not struck through, with "Old key works until {date and time}" and a Revoke button. - Revoke: stops the key at once. This also works on an old key during its 24 hours after a rotation: if you rotated because the key leaked, click Revoke on the old key so it stops now. Revoked keys (and rotated keys once their 24 hours are over) stay in the list, struck through.

Who owns a key

• A key belongs to the person who created it, and it covers the workspaces where that person is an owner or admin at the moment of creation.
• It works only while its creator is still an active owner or admin of every workspace it covers. If they are removed, demoted or their login is disabled, calls fail with "The person who created this API key no longer administers its workspaces. Ask a current admin to issue a new key."
• You see, rotate and revoke only the keys whose workspaces you administer yourself. In an account with many client workspaces, one client's admin cannot see another client's keys.

If something goes wrong

• "This API key has expired. Rotate it under Settings > Developer API keys.": keys last one year. Click Rotate on it in Developer API keys (or create a new one) and update your integration.
• "Invalid or revoked API key": the key was revoked, its 24-hour rotation grace ended, or it was copied incompletely.
• An API key cannot create, rotate or revoke other keys; only a signed-in person can.

Related

• Roles and permissions
• The Settings page