Authentication

Create a workspace key

1. Switch to the workspace the integration should access.
2. Open Settings → Developer tools → API keys and select New API key.
3. Give the key a name that identifies its use, then select Create key.
4. Copy the full sk_... value immediately into a secret manager.

You need API-key management permission to open Developers and create a key. The full value is displayed only once. Systemly stores its hash and later shows only the prefix, creation date, and last-used time. A key is tied to one workspace, even when its creator can access other workspaces.

Send the key securely

Put Authorization: Bearer <key> on each HTTPS API request. A missing or unusable key returns HTTP 401. The current key-creation screen issues both read and write scopes; it does not offer a scope selector. Read endpoints require read, and writes require write. Treat every newly created key as able to change the workspace through the API, and do not expose it to a browser or an untrusted client.

Rotate or revoke a key

1. Create a replacement key in the same workspace and copy it while visible.
2. Update the external application or secret manager, then test a request with the new key.
3. Return to API keys and select Revoke on the old key.

Revocation takes effect immediately and cannot be undone. There is no way to reveal an old key again; create a replacement if its plaintext value is lost. Last-used times are best-effort indicators, not an audit log. Use a separate, clearly named key for each outside system so you can rotate one without interrupting the others.