User API keys

A user API key lets a person call your API from a script or another tool without their password: “generate a key in your account settings.” It acts as that person, with that person’s permissions or a subset of them.

User API keys page — Users & auth → User API keys.

(This is different from the project’s own publishable and secret keys; see Keys and security. For a job, backend or AI agent that should have an identity of its own rather than borrow a person’s, use a machine.)

In Studio

Users & auth → Developers → User API keys. A Keys in this environment table lists every key (owner, name, scopes, last used) with a revoke action. User API key configuration:

Setting	Meaning	Key	Default
Let people create API keys	Off, existing keys stop working too	`directory.api_keys.enabled`	off
Keys per person	The most keys one person may hold	`directory.api_keys.max_per_user`	10
Longest a key may live	Days. 0 lets a key never expire	`directory.api_keys.max_days`	365
Allow scoped keys	A key may be limited to some of its owner’s permissions	`directory.api_keys.scoped`	on

In your app

const created = await pawabase.auth.apiKeys.create({
  name: "Reporting script",
  scopes: ["resource:read"],
  expiresInDays: 90,
});
created.secret;          // shown ONCE. Show it to the person and never store it

const keys = await pawabase.auth.apiKeys.list();   // never includes secrets
await pawabase.auth.apiKeys.revoke(keys[0].id);

created = pb.auth.api_keys.create(name="Reporting script", scopes=["resource:read"], expires_in_days=90)
created["secret"]

keys = pb.auth.api_keys.list()
pb.auth.api_keys.revoke(keys[0]["id"])

Option	Meaning
`name`	A label the person recognises
`scopes`	A subset of the owner’s permissions (when scoped keys are allowed)
`expiresInDays`	Capped by the environment’s Longest a key may live
`org`	Tie the key to one organization

Account page

Build a “Developer settings” page:

List keys with name, scopes, created and last used.
A Create key form. After creating, show the secret once, with a copy button and “you won’t see this again”.
A Revoke button per key.

Using a key

The key goes where a user token would, as the bearer credential for calls made as that person. Rules and permissions apply exactly as for the person, limited by the key’s scopes.

Admin controls

From a server: a.users.apiKeys(userId) lists a person’s keys; a.apiKeys.list() lists all; a.apiKeys.revoke(id) revokes. The events user.api_key_created and user.api_key_revoked are available to webhooks.

Good practice

Default to scoped keys with short lives (30 to 90 days).
Alert on keys unused for months; revoke them.
Remind people that a key is a password: don’t commit it.

Keys and security

The project’s own keys.

Roles

What scopes limit.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

In your app

Account page

Using a key

Admin controls

Good practice

Keys and security

Roles

​In Studio

​In your app

​Account page

​Using a key

​Admin controls

​Good practice

Keys and security

Roles

In Studio

In your app

Account page

Using a key

Admin controls

Good practice