Skip to main content
API keys are the primary way to authenticate requests to the Scrubbe API from your own applications, scripts, or integrations. Each key is scoped to a specific environment and a set of permissions, so you can follow the principle of least privilege across your systems.
Scrubbe shows the raw API key value only once — immediately after creation. Copy and store it securely before leaving the page or closing the response. If you lose the key, you must rotate or delete it and create a new one.

​
Create an API key

Send a POST request with a name, environment, permission scopes, and an optional expiry date.
The response includes the raw key value in a field such as key or rawKey. This value is not retrievable again after this response. Store it in a secrets manager (such as AWS Secrets Manager, HashiCorp Vault, or your CI/CD platform’s secret store) before proceeding.
Use a separate key per environment and per integration. This limits the blast radius if a key is ever compromised, and makes it easy to rotate or revoke access for a single service without affecting others.

​
Use an API key in requests

Pass the key in the X-API-Key header on every request that requires authentication.
cURL
Do not include API keys in query parameters or request bodies. Always use the X-API-Key header to keep the key out of server access logs and browser history.

​
List your API keys

Retrieve metadata for all API keys associated with your account. The raw key value is never returned in this response — only key IDs, names, environments, scopes, and status.
cURL

​
Rotate a key

Rotating a key invalidates the current key value and issues a new one under the same key ID. Use rotation on a regular schedule or immediately if you suspect a key has been exposed.
cURL
The response returns the new raw key value. As with key creation, this value is shown only once. Update your application configuration before the old key stops working.
After rotation, any application still using the old key will start receiving authentication errors immediately. Make sure you update all consumers of the key before or immediately after rotating.

​
Revoke a key

Revoking a key disables it without deleting it. A revoked key cannot be used to authenticate requests, but its record remains visible in your key list.
cURL

​
Delete a key

Permanently removes the key and its metadata from your account. This action cannot be undone.
cURL
Deleting a key is permanent. If an active integration is still using the deleted key, it will fail immediately. Prefer revoking a key if you may need to reference it later, and only delete when you are certain the key is no longer in use.

​
Key management summary