API keys
Creating a key, choosing what it can reach, expiry, and the one moment you can copy it.
Create and manage access tokens for the API.
A key lets a script, a service or an integration act on your workspace without a browser session. The API itself is documented at docs.steerd.io.
Creating one
Give the key a name, choose its access level, and an optional expiry.
Name it after the thing that will use it, not after yourself. "CI deploy token" tells you what breaks if you revoke it; "Anna's key" does not.
Scopes
Access is per resource: organizations, contacts, employees, projects and the rest. For each, choose none, read, or write.
Write includes read.
Grant the minimum that works. A key that only reads projects cannot damage anything even if it leaks, and most integrations genuinely only read.
At least one scope is required, because a key that can reach nothing is not a key.
Expiry
Optional, and worth setting. A key with an expiry fails loudly on a known date. A key without one lives until somebody remembers it exists, which in practice means forever.
Copy it now
The key is displayed once, at creation. Steerd stores a hash, not the key, so it cannot show it to you again and neither can support. Lose it and you create a new one.
Revoking
Immediate. Anything using that key stops working at once, which is what you want when a key has leaked and is inconvenient when you revoked the wrong one. That is the argument for good names.
Creating and revoking keys is recorded in the audit log.