Skip to main content
An API key authenticates REST calls to the StateSet API, whether from the stateset-node SDK, another client library, the CLI, or your own service.

​
From the CLI

A newly created key is shown once. Store it in a secret manager immediately — it cannot be retrieved afterwards, only revoked and replaced.

​
From the dashboard

  1. Open the Keys tab.
  2. Click Create API Key.
  3. Enter a name.
  4. Click Add Key, then copy the value.

​
Using a key

Store the key with the CLI so subsequent commands pick it up:
Or send it directly:

​
Naming keys for what they do

Name each key after the system that holds it — ci-bot, sync-worker, laptop-dom. When you need to revoke one, the name is what tells you what breaks.
Issue a separate key per consumer rather than sharing one. Revoking a shared key takes down everything that used it; revoking a scoped key takes down one thing you already identified.

​
Rotation

There is no in-place rotation. To rotate:
  1. Create the replacement key.
  2. Deploy it wherever the old key is used.
  3. Confirm traffic has moved — stateset cloud whoami from the consumer, or check logs.
  4. Revoke the old key.
Doing it in that order means no window where neither key works.
Last modified on August 29, 2026