# API keys

An API key lets a script, a CI job or an AI agent read your published documentation over HTTP. Keys live in the dashboard under **API & Agents**, are shown to you exactly once, and are scoped to a single workspace.

You do **not** need a key to connect Claude, ChatGPT or Cursor to your docs – that runs over [MCP](/docs/api-and-agents/mcp), which is open for public workspaces. Keys are for the [REST API](/docs/api-and-agents/rest-api).

## Create a key

1.  Open **API & Agents** in the left sidebar.
2.  In the **API Keys** card, click **Create key**.
3.  Give the key a name – something that identifies where it will be used, like `docs-sync-ci` or `support-bot`.
4.  Copy the key from the dialog and store it in your secret manager.

![The API & Agents page with the API Keys card listing one key by name, truncated key, created date and last used](https://res.cloudinary.com/dstack/image/upload/v1785142916/blob_wrrpxs.png)

The full key is shown once, when it is created. Last used is the fastest way to spot a key nothing is calling any more.

Keys are shown once

The dialog says it plainly: _"Copy this key now – you won't see it again."_ Dewstack stores only a hash of the key, so there is no way to recover it later. If you lose a key, revoke it and create a new one.

## What a key looks like

A key is the prefix `dsk_` followed by 40 hexadecimal characters:

dsk\_3f9a1c47e0b28d5641fa9e7c30bd48a2159cd7e0

You send it as a bearer token:

Authorization: Bearer dsk\_3f9a1c47e0b28d5641fa9e7c30bd48a2159cd7e0

The key list shows only the first eight characters, which is enough to tell two keys apart when you are deciding which one to revoke.

## What a key can do

One key grants read access to **one workspace** – the workspace it was created in. There are no per-endpoint permissions and no read-only versus read-write distinction: a valid key can call every endpoint under `/api/public/v1` for its own workspace, and nothing at all for any other workspace.

Only **published** pages are ever returned. Drafts are invisible to the API, so you can keep working in the dashboard without a key-holding integration picking up half-finished pages.

## Rotate and revoke

The key list shows a **Last used** timestamp for every key, updated on each successful call. That column is how you find out whether a key is still wired into something before you remove it – a key that has not been used in months is safe to revoke.

Click **Revoke** on a key's row and confirm. Revocation takes effect immediately: the next request using that key gets `401 Invalid or revoked API key.` Revoking is not reversible, but it also does not affect any other key, so the safe rotation order is:

1.  Create the replacement key.
2.  Deploy it to the integration.
3.  Watch **Last used** on the old key stop moving.
4.  Revoke the old key.

## Who can manage keys

You can create and revoke keys for a workspace if you own it, if it has been [assigned to you](/docs/team-support/assign-workspace), or if you are an **Owner** or **Admin** on the team that owns it.

## Limits and plan requirements

| Limit | Value |
| --- | --- |
| Rate limit | 60 requests per 60 seconds, per key |
| Articles per response | 500 |
| Content returned | Published pages only |
| Scope | One workspace per key; no finer scopes |

The **API & Agents** sidebar entry is hidden without a subscription unless you are in a trial, and for team members without the _Manage SmartDocs_ permission. If you cannot see it, that is why.

## Related

[AI-ready docs Every machine-readable surface Dewstack publishes for you.](/docs/ai-ready-docs/why-ai-ready) [Connect an AI assistant (MCP) Let Claude, ChatGPT or Cursor read your docs live.](/docs/api-and-agents/mcp)