Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.devtune.ai/llms.txt

Use this file to discover all available pages before exploring further.

The API Keys page is the account-level UI for managing project-scoped keys used by the DevTune API and MCP server. Each key belongs to exactly one project, but key management happens from the team-account sidebar so your team can see all keys in one place.

​
What the API Keys Page Shows

The page shows a table of existing keys across the account, including:
  • Name
  • Key prefix
  • Project
  • Status
  • Scopes
  • Expiration
  • Last used
  • Created date
If you have revoked keys, you can use the Hide revoked toggle to keep the table focused on active credentials.

​
Creating a Key

Click Create API Key to open the creation dialog. When creating a key, you choose:
  • A friendly name
  • The project the key should access
  • An optional expiration
  • The allowed API scopes
After creation, DevTune shows the raw key once. Copy it immediately and store it securely.

​
Scopes

API keys can be left broad or narrowed to specific endpoint groups. Use scopes when you want to:
  • Limit a BI dashboard to read-only visibility data
  • Restrict automation to actions or webhook management
  • Give an agent the smallest access surface it needs
If a key has all scopes selected, it behaves like a full-access key for that project.

​
Updating and Revoking Keys

From the table you can:
  • Open the Scopes dialog to narrow or expand endpoint access
  • Revoke a key you no longer trust or need
Revocation is immediate. Revoked keys stop working and can remain visible in the table when you disable Hide revoked.

​
Expiration

Keys support optional expiration windows such as:
  • No expiration
  • 30 days
  • 60 days
  • 90 days
  • 180 days
  • 1 year
Use short-lived keys for temporary automations or contractor access.

​
Permissions

Only team members with the settings.manage permission can manage API keys.

​
Best Practices

  • Create separate keys for separate systems
  • Name keys after the integration that owns them
  • Prefer scoped keys over full-access keys
  • Use expiration for temporary access
  • Revoke keys immediately when an integration is retired

​
Next Steps