API Keys
Workspace API keys are managed in Settings → Keys and authenticate calls to the Woes REST API.Key Properties
Create a Key
1
Open Settings → Keys
Find the Workspace API keys section.
2
Name the key
Use a clear integration name.
3
Create the key
Copy the full secret immediately.
4
Store it safely
Put the key in your server-side secret manager.
Revoke a Key
Revoking a key prevents future use. Create a replacement key before revoking if an integration depends on uninterrupted access.Workspace API keys are not widget keys. Do not use
woesk_ secrets in browser
snippets.Use a Key
401.
Track Usage
Each valid public REST API request is recorded against the workspace and API key that authenticated the request. Admins can use this to understand which integrations are using the public API and to audit rotation work. Usage records do not store raw request bodies, raw responses, API key secrets, or customer-private payloads.Supported Scopes
Unscoped keys can call every REST API endpoint. Scoped keys can be limited to specific resources:
If a scoped key calls an endpoint outside its allowed scopes, the API returns
403 insufficient_scope.
Only these exact scopes are accepted by the API key model. Leaving the scope
list empty creates an unrestricted key. The current Settings UI creates named
workspace API keys without a scope picker; scoped key creation is available
where backend or administrative tooling supplies the scope list.