The API Keys API allows you to programmatically manage and validate API keys used by your organization. This is useful for building internal tools, implementing security workflows, or managing API key lifecycles.
Never commit API keys to version control. Use environment variables or secret management services like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault.
Rotate Keys Regularly
Implement a key rotation schedule (e.g., every 90 days) to minimize the impact of potential key compromise.
Use Least Privilege
Create API keys with only the permissions necessary for their intended use case.
Monitor Usage
Track lastUsedAt timestamps to identify unused or suspicious API key activity.
Revoke Compromised Keys
Immediately delete API keys that may have been exposed or compromised.
import { WorkOS } from '@workos-inc/node';const workos = new WorkOS('sk_example_123456789');async function rotateApiKey(oldKeyValue: string) { // Step 1: Validate the old key const validation = await workos.apiKeys.validateApiKey({ value: oldKeyValue, }); if (!validation.apiKey) { throw new Error('Invalid API key'); } // Step 2: Create new key (via WorkOS Dashboard or API) // Note: Key creation typically happens through the WorkOS Dashboard console.log('Create a new API key in the WorkOS Dashboard'); // Step 3: Update your application to use the new key console.log('Update environment variables with new key'); // Step 4: Delete the old key await workos.apiKeys.deleteApiKey(validation.apiKey.id); console.log('Old API key deleted successfully');}// UsagerotateApiKey('sk_live_old_key_value');