An ApiKey lets a workspace call the platform's APIs without a human logging in. Each key belongs to a tenantId and records createdById to show who issued it, plus a human-friendly name. The secret itself is never stored directly — only its keyHash and a short keyPrefix for identification. A readOnly flag can limit a key to non-mutating calls, while lastUsedAt, expiresAt, and revokedAt track its lifecycle so administrators can rotate or disable keys that are stale or compromised.
Technical section
Data model, API, and internals — visible to developers.