Authentication & Tokens

The public API uses bearer tokens. Each token belongs to one user, and every notification pushed with it is delivered to that user.

Create a token

1. Open API Tokens in the console.
2. Press Create token and give it a name, for example sso log or jenkins logs.
3. Copy the key immediately. It is shown in full only once. Afterwards only a masked version is displayed.

The token name is the notification tag. Choose a name that tells you where alerts come from. The name internal is reserved for the uptime checker.

Use a token

Send the key in the Authorization header of every request:

Authorization: Bearer sk_live_8f3a9b1c2d4e5f6a7b8c9d0e1f2a3b4c
Content-Type: application/json

Keys start with sk_live_ followed by 32 hexadecimal characters.

Revoke a token

Press Revoke next to a token. Revoked tokens are rejected immediately with 401. Pressing the delete button on a revoked token removes it from the list.

Security guidelines

• Treat a token like a password. Never commit it to a repository or expose it in client-side code.
• Create one token per integration so you can revoke a single system without breaking the others.
• Store keys in your CI/CD secret store or environment variables.
• If a key leaks, revoke it and create a new one.
• Always call the API over HTTPS.

Limits

• Up to 5 active tokens per account.
• Each token is limited to 60 requests per minute by default. See FAQ & troubleshooting.