Revoke or rotate an API key

Revoking a key cuts it off immediately: the next request that uses it fails with 401 and “API key is invalid or revoked.”

1. Open Settings (Ctrl,), or choose Settings and backups from the account menu at the bottom of the sidebar.
2. Go to the Workspace tab and scroll to API keys.
3. Find the key by its name, workspace and first few characters.
4. Select the trash icon at the end of its row.

Rotate a key

Keys can’t be renewed or extended. To replace one without a gap:

1. Create a new key for the same workspace, with the same access.
2. Put the new key wherever the old one was used, such as ~/.config/scribblespace/credentials.json or the SCRIBBLESPACE_API_KEY variable.
3. Check that it works, then revoke the old key.

If a key leaks

Revoke it straight away, then create a new one. Scribblespace stores keys only as hashes, so nobody can read a key back from it, you included.

When keys stop working on their own

• Expired: a key lasts as long as you chose when you created it. After that, requests fail with “API key expired.” and the key is cleared from the list automatically.
• Left the workspace: if you leave the key’s workspace or are removed from it, the key stops working.
• Became a viewer: a read-and-write key can still read, but its writes are refused.

Owners and admins can see when keys are created and revoked on the team’s Activity page.