For: Admins
Restrict or revoke an API key
Limit a key to certain IP addresses, switch it off, or delete it, and see when it was last used.
In this article6 sections
Before you start
Check when each API keyKey A secret token, created under Integration, that lets your own software use the hub's API. was last used, limit it to your system's address, switch it off for a while, or delete it for good, such as when a key may have leaked or the system using it is retired.
Check its last use
In Integration › Keys, Last Used shows the date of each key's latest call, and Last Used IP the address it came from. A call refused because the key is off, on the wrong API or from outside its range isn't counted. A dash means it hasn't been used.
Limit it to your address
Choose the pencil icon, Edit key, on its row. Under Source CIDR, type your system's public IPv4 address, such as the one under Last Used IP, or a range, such as 203.0.113.0/24. To let it be used from any address again, empty the box. Choose Save. "Key saved" shows, and calls from other addresses are refused from then on.
Switch it off
To stop a key for now, open it with Edit key, turn Active off and choose Save. Every call with it is refused until you switch it back on.
Delete it
To stop a key for good, choose the bin icon, Delete key, on its row, then Delete. "Key removed" shows. It stops working at once and can't be brought back.
What happens next
Nobody is told when you change or delete a key. Your system's calls with it are refused from then on; see Authenticate API requests with a key for what it gets back.
If a key may have leaked, switch it off straight away. Then create a new key, move your system to it, and delete the old one. A key's type can't be changed either: create a key of the other type, then delete this one. Your hub can hold two keys of each type, so with two already, delete one first.