Skip to main content
An API key belongs to one project and one environment. It tells GOL which developer application made a request. Its scopes limit API access, but the key is never a substitute for an account owner’s approval.

​
Choose the smallest scope

For the current first-request flow, select project:read. It is enough for GET /v1/whoami. The schema also lists scopes for future account, mandate, action, and webhook operations. Their presence in a key or schema does not make those capabilities available. The test environment is available in the local control plane. Live project and credential creation returns capability_unavailable while the release profile is inactive.

​
Keep keys on the server

Send the key in the Authorization header from a backend service:
Do not put the value in a web page, mobile bundle, URL, analytics event, issue, or repository. GOL displays the new secret once. Later views show only a hint so you can identify the key without exposing it.

​
Rotate or revoke

Rotate a key when you need to replace it without an abrupt cutover. The local console supports a bounded overlap window so your server can switch to the new secret. Update your server configuration, verify a request using the new key, then let the old key expire or revoke it. Revocation immediately makes the old key unusable. If a key may be exposed, revoke it immediately and issue a new one. Review the project’s audit events to see authentication activity. See make your first request for the verification call.