API keys

API keys authenticate automation to one RestoreTrust project. They do not replace organization membership for people.

Create a key

1. 1

   Open API keys in the project

   Select the intended project, open API keys, and choose Create. A signed-in user must create the key.

2. 2

   Name its purpose

   Use a name and description that identify the consuming system and owner. Avoid generic names such as “automation.”

3. 3

   Set an expiry date

   Every key requires an expiry. It is a UTC calendar date, and the key remains valid through the end of that UTC day regardless of your console time-zone setting. Choose the shortest practical lifetime; the maximum available expiry is three years from creation.

4. 4

   Select scopes

   Grant only the required resources and actions. Actions are read, write, and delete where supported. The current console catalog is authoritative for available scopes.

5. 5

   Copy the key once

   Store the raw key in your secret manager immediately. RestoreTrust shows it only at creation and cannot display it again.

Current resource groups can include checks, sources, reports, secret metadata, notification channels, schedules, messages, project workers, and API keys. Do not grant write or delete scope when the integration only reads results.

Operate and rotate keys

• Pause a key to stop access temporarily without deleting its record.
• Reactivate a paused, unexpired key when appropriate.
• Create and deploy a replacement before deleting the old key.
• Treat an expired key as unusable; update the integration with a new key.
• Delete a key immediately when its value might have been exposed.

For request authentication and project scoping, continue with the API quickstart and authentication reference.

Check Plan/Quotas before creating keys because availability and quantity depend on the current plan.