Managing API Keys
The API Keys page lets you create, view, and manage the keys your applications use to call the FourA API.
Viewing Your Keys
The page shows every key you have access to:
- Personal keys you created directly.
- Organization keys if you're an org owner or admin, or if a key you own has been transferred to one of your orgs.
Each row in the table shows:
| Column | What it shows |
|---|---|
| Name | Display name and (optional) description |
| Key | Masked prefix (e.g. pk_live_••••••••) with a Reveal button next to it |
| Owner | Personal for personal keys, or the organization name for org-owned keys |
| Status | Active or Inactive |
| Created | When the key was created |
| Last Used | When the key last made a request |
Use the search box to filter by name or description, and the status filter to show only active or inactive keys. Every column header is sortable.
Creating a Key
Click Create Key and fill in:
| Field | Required | Description |
|---|---|---|
| Name | Yes | A descriptive label (e.g., "production-scraper" or "staging-test") |
| Description | No | Notes about what this key is used for |
| Owner | Yes if you're in an org | Personal, or one of the organizations you belong to. The picker only appears when you have at least one org. |
The full key is shown once right after creation in a copy-ready dialog. You can also bring it back later via Reveal (see below).
Keys use the pk_live_ prefix and look like pk_live_a1b2c3d4e5f6.... You'll get an email confirmation when a new key is created.
Revealing a Key
Click the eye icon next to a key's masked prefix to see its full secret again. The dashboard asks you to confirm, then opens a dialog with the plain key, a copy button, and a short countdown. After the countdown, the dialog wipes the secret from the page.
Every reveal is recorded in the audit log because it exposes a live credential.
Legacy Keys
Keys created before the reveal feature shipped show a lock icon instead of the eye and can't be revealed. Only their hash was stored, so the original secret is unrecoverable. To switch a legacy key over, click the actions menu and choose Regenerate. The new secret is revealable from then on.
Who Can Reveal
| Role | Can reveal |
|---|---|
| Key owner | Yes |
| Org owner or admin (for org-owned keys) | Yes |
| Anyone else | No |
Editing a Key
Click Edit on any row to update the display name and description. Ownership (personal vs org) isn't changed here. Use Transfer below to move a key between owners.
Activating and Deactivating
Use the Disable / Enable button on the row to toggle a key's status. Deactivating a key blocks all API requests that use it. You can reactivate it at any time. The change takes effect within seconds.
Regenerating a Key
If you suspect a key has been compromised, open the actions menu (the three-dot button) and choose Regenerate. This creates a new secret for the same key ID. The old secret stops working immediately. Name, org assignment, and other settings stay the same.
The new secret stays revealable after the dialog closes, so you don't have to copy it perfectly on the first try.
Transferring a Key
Every row has a Transfer action in the menu. Use it to move a key between personal and organization ownership without regenerating the secret. The key ID, its metrics, and its activity history are preserved; only the owner changes.
Common cases:
- Move a personal key you built for a shared project into the org so a teammate can manage it after you.
- Reassign an org key back to yourself if the project spins out.
You can transfer a key you own (personal) into any org where you're an owner or admin, and you can transfer an org key you administer to yourself or between orgs you administer.
Deleting a Key
Open the actions menu and choose Delete. Deleting a key you've used before soft-deletes it: the key stops authenticating but its Activity and Metrics history remain intact. Keys that have never been used can be hard-deleted.
You'll get an email notification when a key is deleted.
Organization Keys
Keys owned by an organization are visible to org owners and admins. Members without owner or admin role don't see them.
Usage on an org-owned key counts against the org owner's plan.
Related
- Authentication: How API keys work with the API
- Organizations and Teams: Setting up shared access
- Dashboard Overview: All dashboard sections