Skip to main content

​
API Keys

An API key authenticates REST calls to the StateSet API, whether from the stateset-node SDK, another client library, the CLI, or your own service.

​
From the CLI

A newly created key is shown once. Store it in a secret manager immediately — it cannot be retrieved afterwards, only revoked and replaced.

​
From the dashboard

  1. Open the Keys tab.
  2. Click Create API Key.
  3. Enter a name.
  4. Click Add Key, then copy the value.

​
Using a key

Store the key with the CLI so subsequent commands pick it up:
Or send it directly:

​
Naming keys for what they do

Name each key after the system that holds it — ci-bot, sync-worker, laptop-dom. When you need to revoke one, the name is what tells you what breaks.
Issue a separate key per consumer rather than sharing one. Revoking a shared key takes down everything that used it; revoking a scoped key takes down one thing you already identified.

​
Rotation

There is no in-place rotation. To rotate:
  1. Create the replacement key.
  2. Deploy it wherever the old key is used.
  3. Confirm traffic has moved — stateset cloud whoami from the consumer, or check logs.
  4. Revoke the old key.
Doing it in that order means no window where neither key works.