API keys
Create, edit and revoke the read-only API keys that give your own tools access to one Opttab workspace.
An API key lets a script or tool outside Opttab read one workspace through the Opttab API. You manage keys in Settings › API.
How it works
Create a key
Open API settings
Go to Settings › API (API Settings) and click Create API Key.
Name the key
Enter a Key Name, for example "Production Backend". Use up to 60 characters. Each name must be unique in your account.
Choose the workspace
Pick the Workspace. The key can read only this workspace.
Pick scopes
Tick at least one scope. Give the key only what your tool needs.
| Scope | Label in the app | What the key can read |
|---|---|---|
v2:org | Access organization and workspace info | The workspace and its competitors |
v2:prompts | Access prompts and their AI responses | Prompts, AI answers, cited sources and topics |
v2:metrics | Access visibility and dashboard metrics | Visibility summary and analytics KPIs |
Limit where it works (optional)
In Allowed addresses, enter one IP address or CIDR range per line, such as 203.0.113.10 or 198.51.100.0/24. Up to 20 entries. Leave it empty to allow every address.
Set an expiry (optional)
Turn on Expiration and pick a Date. The key stops working at that time, in your time zone. The date must be in the future.
Create and copy
Click Create API Key. On Copy your API key, click Copy key, store the secret safely, then click Done.
Manage your keys
The Keys table lists every key in your account with Key Details, Workspace, Permissions, Expiration and Actions.
- A key shows as its first characters and last four characters only. The full secret is never shown again.
- Expiration reads Never for a key without an expiry date, and Expired once its date has passed.
- Edit changes the name, workspace, scopes, allowed addresses and expiry. It never shows or changes the secret.
Revoke a key
Find the key
In Settings › API, find the key in the Keys table.
Delete it
Click Delete. In Revoke this API key?, click Revoke key.
The key stops working at once. Any call that still uses it gets 401 API_KEY_INVALID.
Limits
| Limit | Value |
|---|---|
| Keys per account | 25 |
| Allowed addresses per key | 20 IP addresses or CIDR ranges |
| Key name | 1–60 characters, unique in the account |
| Workspaces per key | 1 |
| Requests | 60 per 60 seconds per key |
Errors when you manage keys
| What you see | Why | Fix |
|---|---|---|
API_KEY_LIMIT_REACHED | Your account already has 25 keys. | Delete a key you no longer use. |
API_KEY_NAME_TAKEN | Another key has this name. | Choose a different Key Name. |
| "Choose an expiry date in the future" | The Date is in the past. | Pick a later date. |
| "Enter an IP address or a CIDR range." | A line in Allowed addresses is not valid. | Fix or remove that line. |