TL;DR: Settings → API keys. Each key has a name and an expiry. Generate one per integration, and rotate before it lapses. The secret is shown once and never again.
Creating a key
Settings → API keys, then create a key. There are two fields:
- Name — what's this key for? ("HubSpot sync", "n8n workflow X", "Claude Desktop")
- Expires — 3 months, 6 months, or 1 year. The default is 3 months, and 1 year is the maximum. There is no non-expiring option; every key lapses.
Keys are not scoped. A key carries the access your workspace has — there are no read-only or per-endpoint permission tiers to choose from, so treat every key as a full-access credential.
The secret is shown once, on creation, and starts with unstk_. Copy it then. The database stores only a SHA-256 hash, so once that dialog closes nobody — including support — can recover it. If you lose it, rotate the key.
Storing the key
Treat API keys like passwords:
- Do store them in your secret manager (1Password, AWS Secrets Manager, a CI vault) or an environment variable
- Don't commit them to git, paste them into Slack, or put them in a shared doc
Listing keys
The table shows five columns:
- Name
- Prefix — the leading characters, enough to tell one key from another without exposing it
- Created
- Last used
- Expiry
There's no "created by" column, and no status column. Revoked keys are removed from the list entirely rather than shown as revoked, so everything you see is either active or lapsed.
Rotating a key
Rotate before expiry, and on any personnel change. Rotating reveals a new secret the same way creation does.
The safe order is: rotate, update the consumer with the new secret, confirm the integration still works.
Rotate and revoke are only offered on active keys — once a key has lapsed, neither applies, and you create a fresh one instead.
Revoking a key
Revoke from the key's row. It takes effect immediately: the next call with that key fails. Revoke when someone leaves, when a key may be compromised, or when an integration is decommissioned.
Revocation is irreversible, and the key disappears from the list. To restore access, create a new key.
Spotting stale keys
Last used is the column that tells you which keys still matter. A key that hasn't been used in months is usually safe to revoke — confirm the integration is genuinely retired first.