Skip to content
ATLAS
 Docs
On this page

Monitor and revoke API keys#

Review every API key in your organisation, check the revocation history, and revoke a key that should no longer work.

Before you begin#

  • You need the Admin or Owner role. Both can review and revoke every key in the organisation. Project managers and Account Managers can revoke only project keys, from the project page. Roles and permissions lists what each role can do.

Review the keys#

  1. In the sidebar, open Manage > API keys.

  2. Read the summary strip at the top. It shows:

    • the number of Active keys
    • keys created This month
    • keys that were Never used
    • keys Expiring soon, which expire within 30 days
    • keys Revoked this month
    • a tile for the busiest key, labelled with its name (or Top key when there is none)

    The Expiring Soon badge in the Status column of the table is stricter. It marks keys that expire within 7 days.

  3. In the API Keys tab, scan the table. The columns are Context, Key, Owner, Usage, Status and Created.

  4. Use the column filters to narrow the list, for example by key name, owner, space or project. Context shows the space or project a key is acting under. It flags keys of Over budget or Archived projects.

Review the revocation history#

  1. Switch to the Revocations tab.
  2. Read each row. It shows the credential, who revoked it and when (Revoked By, Revoked At), and the number of Requests. It also shows the space or project the key was acting under at that moment.

Rows stay after the spaces, projects or users involved are deleted.

Revoke a key#

  1. In the API Keys table, open the actions menu (⋮) on the row and select Revoke.
  2. In the Revoke API Key? dialog, select Revoke Key.

Result: ATLAS records the key in the revocation history with you as the revoker, then deletes it. The key stops working within seconds.

Check the keys of a space#

Open the space and choose the Active Keys tab. It's available for Team spaces and is read-only. It shows only the end of each key. To revoke, use the organisation's API keys page.

Good to know#

  • The maximum key lifetime is set once for the whole organisation. See Cap API key lifetime.
  • Removing a person from a space or project unbinds their keys but doesn't delete them.
  • Suspending an organisation or archiving a project makes the gateway refuse calls made with the affected keys.