Skip to main content
POST
JavaScript
Same contract as rotating a workspace key, with account-wide blast radius: the response carries the new token, and every previous token stops authenticating in all workspaces the moment it lands.
If the token you present on this call is the global key’s own token, you are invalidating your own credential mid-request. The call succeeds and returns the replacement; every subsequent request must use the new value. Capture spec.token before anything else runs.
Rotation is the only way to see the global key’s token without holding scopes that dominate it, since the read endpoint withholds the token from weaker callers.

Get the global key

When the token comes back on a read, and when it does not.

Disable the global key

Stop the bleeding first, rotate second.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

OK

An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.

metadata
object
required

AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

spec
object
required

Configuration for an API key.

state
enum<string>
required
read-only

The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.

Available options:
STATE_UNSPECIFIED,
STATE_ENABLED,
STATE_DISABLED
info
object