← Back to all articles
tutorialapiautomation

Create and Manage API Keys

By Middlewr Team··3 min read
Create and Manage API Keys

API keys let you interact with Middlewr programmatically — create links, read analytics, or manage your workspace through the API. Each key has a permission level that controls what it can access. This guide covers creating, using, and deleting API keys.

Prerequisites

  • A Middlewr account
  • The Admin role on the workspace (API key management is restricted to admins)

Step 1: Navigate to API Keys

Go to Settings from the sidebar, then click the API Keys tab. This page lists all existing API keys for the workspace, showing their name, key prefix, permission level, last used date, and creation date.

If no keys exist yet, you'll see an empty state inviting you to create your first one.

API Keys settings page

Step 2: Create an API key

Click Create API Key. A modal appears with two fields:

  1. Name — a descriptive label to identify this key (e.g., "CI/CD Pipeline", "Marketing Automation").
  2. Permissions — select the permission level for this key from a dropdown. The available levels depend on your own role — you can only grant permissions equal to or lower than your own.

Click Create to generate the key.

Create API key modal

Step 3: Copy your key

After creation, a dialog displays your full API key. This is the only time the key is shown — copy it immediately and store it somewhere secure (a secrets manager, environment variable, etc.).

The key prefix (first characters followed by ...) will remain visible in the table for identification, but the full key cannot be retrieved again.

Key revealed after creation

Deleting an API key

To remove a key, click the delete button next to it in the table. A confirmation dialog will ask you to confirm, warning that any application using this key will immediately lose access. This action cannot be undone.

Security best practices

  • One key per integration — don't share a single key across multiple services. If one is compromised, you can revoke it without affecting others.
  • Use minimum permissions — give each key only the access level it actually needs.
  • Monitor usage — the "Last used" column helps you identify unused keys that should be deleted.
  • Rotate regularly — create a new key, update your integration, then delete the old one.

Going further

Now that your API keys are set up, here are a few things to explore next: