API keys API

An API key gives a script, CI job, SDK, or agent access to one project. Use this API only when an operator asks for a key change: key operations are sensitive, and hosted MCP hides them by default.

Operations

Operation	Method and path	Purpose
`apiKeys.list`	`GET /v1/projects/{project_id}/api-keys`	List API key metadata for a project.
`apiKeys.get`	`GET /v1/projects/{project_id}/api-keys/{key_id}`	Get metadata for one key.
`apiKeys.create`	`POST /v1/projects/{project_id}/api-keys`	Create a key with `{ label, scopes, expires_at? }`.
`apiKeys.update`	`PATCH /v1/projects/{project_id}/api-keys/{key_id}`	Update key label or scopes.
`apiKeys.delete`	`DELETE /v1/projects/{project_id}/api-keys/{key_id}`	Revoke a key.

Secrets and access limits

Squasher stores only a SHA-256 hash of each key. apiKeys.create returns the full key once, in the create response. apiKeys.list and apiKeys.get return only key_prefix, the first characters of the key, so you can match a key to where it is used. Nobody can read the full key again. If you lose a key, create a new one and revoke the old one. A revoked key stops working within a minute. Only an ingest-only key (scope events:ingest) is safe to put in browser or mobile code. Keep every other key secret. A caller cannot give a key more access than the caller has:

An API key can create, change, or revoke only keys whose scopes it holds itself. For example, a key with write cannot create a key with *, and only a key with the exact remote_access:* scope can pass that scope on.
A signed-in user of the CLI or MCP must be an owner, admin, or security admin, as in the dashboard. Only owners and admins can grant the remote-access administration scopes.

apiKeys.create can return a secret that is shown once. Never log it, paste it into public artifacts, or include it in agent transcripts beyond the minimum private handoff the operator requested. The dashboard hides a new key by default, including from page text read by agents. Select Copy key to copy it without showing it, or Reveal key to read it. Select Hide key to hide it again. The Setup page uses the same controls for an ingest key. Raw AI dataset export is intentionally separate from ordinary read access. Add the exact ai:export scope when a key needs to call agentObservations.export; read, write, and errors:read do not imply it. The * scope grants general API permissions, but it does not grant sensitive remote_access:* permissions. Add each required remote-access scope explicitly. Remote-access actions use separate scopes. The broad read scope does not include remote access: every remote-access call with an API key needs the exact remote_access:* scope. An agent key needs the exact remote_access:request scope to preview, create, inspect, or cancel its owned requests. A key must have the exact remote_access:manage scope for administration. Do not put management scope on an agent key. Approval decisions, signing-key fingerprint reveal, target confirmation, and transcript reveal are protected human workflows. Do not use an API key for them. Scopes for findings, investigations, releases, services, analytics, and providers follow the usual rules: read includes every :read scope, and write includes every :read and :write scope. actions:approve lets a caller approve a proposed remediation. read and write do not include it. Add it explicitly, and only to a key that a person controls. Revenue scopes are also outside the shortcuts: read and write do not include revenue:read or revenue:write. Add them explicitly to a key that needs revenue. In the dashboard, only owners and admins can see revenue.

Scope	Grants
`findings:read` / `findings:write`	Read detector findings; acknowledge or attach them.
`investigations:read` / `investigations:write`	Read investigations; start or steer them.
`releases:read`	Read releases and their serving intervals.
`services:read`	Read services, hosts, workloads, and other entities.
`analytics:read` / `analytics:write`	Read product analytics; change analytics settings.
`providers:read` / `providers:write`	Read provider resources; connect providers.
`revenue:read` / `revenue:write`	Read revenue and MRR; send revenue, set currency.
`actions:approve`	Approve a proposed remediation before it runs.

CLI and MCP

Use squasher api-keys to list, create, change, and revoke keys. Creating a key, replacing its scopes, and revoking it ask for confirmation; pass --yes in scripts. The new key’s secret is printed once.

squasher api-keys create --project <project_id> --label "CI uploads" --scope sourcemaps:write --yes
squasher api-keys update <key_id> --project <project_id> --scope events:ingest --scope sourcemaps:write --yes
squasher api-keys revoke <key_id> --project <project_id> --yes

Hosted MCP hides API key operations; do not assume search("apiKeys") will return runnable operations.

Agent handoff

Manage Squasher API keys only after explicit user confirmation. Verify project id, desired scopes, expiration, and label. Never expose full key secrets in output, and ask before creating, updating scopes, or revoking a key.

Related: Quickstart, MCP.

Start here

Resources

Operations

Secrets and access limits

CLI and MCP

Agent handoff

​Operations

​Secrets and access limits

​CLI and MCP

​Agent handoff

Operations

Secrets and access limits

CLI and MCP

Agent handoff