An API key lets a script, a CI job or an AI agent read your published documentation over HTTP. Keys live in the dashboard under API & Agents, are shown to you exactly once, and are scoped to a single workspace.

You do not need a key to connect Claude, ChatGPT or Cursor to your docs – that runs over MCP, which is open for public workspaces. Keys are for the REST API.

Create a key

  1. Open API & Agents in the left sidebar.
  2. In the API Keys card, click Create key.
  3. Give the key a name – something that identifies where it will be used, like docs-sync-ci or support-bot.
  4. Copy the key from the dialog and store it in your secret manager.
The API & Agents page with the API Keys card listing one key by name, truncated key, created date and last used
The full key is shown once, when it is created. Last used is the fastest way to spot a key nothing is calling any more.

Keys are shown once

The dialog says it plainly: "Copy this key now – you won't see it again." Dewstack stores only a hash of the key, so there is no way to recover it later. If you lose a key, revoke it and create a new one.

What a key looks like

A key is the prefix dsk_ followed by 40 hexadecimal characters:

dsk_3f9a1c47e0b28d5641fa9e7c30bd48a2159cd7e0

You send it as a bearer token:

Authorization: Bearer dsk_3f9a1c47e0b28d5641fa9e7c30bd48a2159cd7e0

The key list shows only the first eight characters, which is enough to tell two keys apart when you are deciding which one to revoke.

What a key can do

One key grants read access to one workspace – the workspace it was created in. There are no per-endpoint permissions and no read-only versus read-write distinction: a valid key can call every endpoint under /api/public/v1 for its own workspace, and nothing at all for any other workspace.

Only published pages are ever returned. Drafts are invisible to the API, so you can keep working in the dashboard without a key-holding integration picking up half-finished pages.

Rotate and revoke

The key list shows a Last used timestamp for every key, updated on each successful call. That column is how you find out whether a key is still wired into something before you remove it – a key that has not been used in months is safe to revoke.

Click Revoke on a key's row and confirm. Revocation takes effect immediately: the next request using that key gets 401 Invalid or revoked API key. Revoking is not reversible, but it also does not affect any other key, so the safe rotation order is:

  1. Create the replacement key.
  2. Deploy it to the integration.
  3. Watch Last used on the old key stop moving.
  4. Revoke the old key.

Who can manage keys

You can create and revoke keys for a workspace if you own it, if it has been assigned to you, or if you are an Owner or Admin on the team that owns it.

Limits and plan requirements

Limit Value
Rate limit 60 requests per 60 seconds, per key
Articles per response 500
Content returned Published pages only
Scope One workspace per key; no finer scopes

The API & Agents sidebar entry is hidden without a subscription unless you are in a trial, and for team members without the Manage SmartDocs permission. If you cannot see it, that is why.

AI-ready docs Every machine-readable surface Dewstack publishes for you. Connect an AI assistant (MCP) Let Claude, ChatGPT or Cursor read your docs live.