API keys

When to use an API key

• A backend service or worker that reads or writes Project data.
• A CI job or script that imports or exports records.
• A partner integration that needs access to a few tables only.

Create a key

1. Open your Project and select API keys.
2. Select New API key and give it a clear name, such as Billing worker.
3. Choose the permission: read only, or read and write.
4. Under Allowed collections, pick the tables the key may use. Leave it empty to allow every table.
5. Optionally set an expiry date.
6. Select Create and copy the key right away. It is shown only once.

Use the key

Send the key in the X-API-Key header. The console's Copy cURL example button fills in your Project address for you.

curl "https://my-app.rustabase.net/api/v1/collections/orders/records"               -H "X-API-Key: YOUR_API_KEY"

import { createClient } from "rustabase";

const rb = createClient("https://my-app.rustabase.net");
const headers = { "X-API-Key": process.env.RUSTABASE_API_KEY };

const orders = await rb.from("orders").list({ sort: "-created", headers });

Rotate, disable, or revoke

const rotated = await rb.admin.apiKeys.rotate("KEY_ID"); // new secret, shown once

Good practice

• Create one key per service, so you can rotate or revoke one without affecting others.
• Give each key the fewest tables and the lowest permission it needs.
• Set an expiry date for temporary access.
• Check Last used on the keys list and revoke keys nobody uses.
• Keep keys in your hosting provider's secret settings, never in a repository.