Skip to main content
API Keys authenticate server-to-server integrations with the Humanos API. Each key comes with two secrets that work together:
  • the API Key itself, sent on every request as a bearer token in the Authorization header
  • the Signature Secret, used to sign each request body so Humanos can verify it wasn’t tampered with in transit
Both are required — a request with a valid key but a bad signature is rejected with 401. The Authentication page documents the signing scheme; the SDK signs automatically.

​
Features

  • Generate: creates a new key. The secret is shown once at creation, so copy it immediately — it cannot be recovered later, only rotated
  • Rotate: issues a new secret and immediately invalidates the old one. Rotate on a schedule and whenever a secret may have been exposed (a leaked log, a departed contractor, a compromised CI system)
  • Active: toggle the key’s validity in real time without deleting it, preserving audit history — useful for suspending an integration while investigating
  • Set an expiry date: the key stops working at that date. Set expiry dates on keys created for temporary work (pilots, migrations, load tests) so they can’t outlive their purpose
  • Delete: permanently removes the key

​
Practices worth adopting

  • One key per integration. A key per service isolates blast radius on rotation and keeps audit trails attributable. Rate limits are also applied per key, so separate workloads don’t compete for the same budget.
  • Store secrets in a secret manager, not in code or .env files committed to a repository.
  • Rotate immediately on any suspicion of exposure — rotation is instant and the only cost is updating the consuming service.

​
Who can manage keys

Members with the Technical or Owner role can create, rotate and delete API keys (see Member roles). Managers cannot — key custody is deliberately separated from workflow administration.