API keys

Three kinds of key exist, each for a different caller.

Environment key. One per environment, shown in the environment's edit dialog (on Basic and Standard under Setup → Access → API Key). It authenticates trigger URLs and webhook URLs without a key of their own, and it names the environment a call reaches. It may call only the trigger routes, the run and load-log status routes, queue status and the webhook ingest; anything else is refused. Generate new key replaces it, and anything using the old key stops working when you save.

Webhook key. Issued in a dataset's Webhook setup, bound to that dataset and environment, embedded in the webhook URLs as ?key=. It lets the sender hold a key that can be revoked on its own, and can be shown again in the dialog.

Agent key. Issued on an on-prem instance for the Gateway, bound to that instance and environment, and shown once. It may call the Gateway's ingest routes only. Revoking it stops the Gateway using it.

Send a key as the X-API-Key header. For human-driven calls prefer the sign-in token.