API keys

Create, scope, rotate and revoke keys for scripts and integrations.

An API key lets a script, a CI job or an AI agent act on your workspace without a browser session.

Authorization: Bearer gl_...

Creating one

Keys are created in Settings → API keys, with a name, an expiry, and a set of permissions.

Expiry	When	Free	Pro	Business
1 day	A laptop, a debugging session, a credential you want gone by tomorrow	✓	✓	✓
7 days	A one-off job or a short contract — expires without anyone remembering to revoke it	✓	✓	✓
30 days	Short-lived automation, one-off tasks	✓	✓	✓
90 days	A reasonable default	✓	✓	✓
365 days	Long-lived integrations you will remember to rotate	—	✓	✓

A dash means the plan's ceiling is shorter than that lifetime: Free caps at 90 days, Pro caps at 365 days, Business caps at 365 days. Omitting an expiry resolves to that ceiling, not to “never” — an unbounded credential is not a default anyone should get by omission.

Where a key may be used

A key also declares its surfaces — which APIs will accept it at all.

Surface	What it opens	Give it to
`rest`	The REST API at api.glowo.dev	CI jobs, scripts, your own integrations
`mcp`	The Model Context Protocol transport at /mcp	An AI agent you have pasted a key into

A key minted for mcp is refused on the REST API with 403, and a rest key is refused by the agent transport. The credential is perfectly valid in both cases; it is simply not for that door, and re-presenting it will never help.

This matters more than it looks. The MCP tool list is a much smaller surface than the REST API — there is no status-page-delete tool, but there is a REST route — so a key someone reviewed as “it can only use these tools” must not also open everything behind the REST guard.

Capabilities a key can hold

Capability	Grants	Also carries	Assignable to a key
`monitors:read`	Read monitors and heartbeats	—	✓
`monitors:write`	Create, update, pause and resume monitors; run on-demand checks	`monitors:read`	✓
`monitors:delete`	Delete monitors	`monitors:read`	✓
`status_pages:read`	Read status pages	—	✓
`status_pages:write`	Create, update and publish status pages	`status_pages:read`	✓
`status_pages:delete`	Delete status pages	`status_pages:read`	✓
`incidents:read`	Read incidents	—	✓
`incidents:write`	File, update, resolve and reopen incidents	`incidents:read`	✓
`incidents:delete`	Delete incidents	`incidents:read`	✓
`postmortems:read`	Read postmortems	—	✓
`postmortems:write`	Write and publish postmortems	`postmortems:read`	✓
`postmortems:delete`	Delete postmortems	`postmortems:read`	✓
`notifications:read`	Read notification channels and delivery history	—	✓
`notifications:write`	Manage notification channels and send tests	`notifications:read`	✓
`notifications:delete`	Delete notification channels	`notifications:read`	✓
`maintenance:write`	Schedule maintenance windows	—	✓
`identity:read`	View workspace and plan	—	✓
`workspace:manage`	Manage workspace settings	—	—
`billing:manage`	Manage billing and subscription	—	—
`members:manage`	Invite and manage members	—	—
`audit:read`	Read the audit log	—	—

The four marked unassignable are session-only by design. A leaked key must not be able to change your billing, add members, alter workspace settings, or read the audit log that would show what it did.

Give each key the least it needs. A key that only reads monitors for a dashboard should carry monitors:read and nothing else — not monitors:write, and certainly not monitors:delete.

Rotating and revoking

Rotate issues a new secret for the same key, keeping its name and permissions. Use it on a schedule and whenever someone with access leaves.
Revoke disables the key immediately while keeping the record, so the audit trail survives.
Delete removes it entirely.

Rotate rather than delete-and-recreate: rotation keeps the key’s identity and history intact.

Keeping keys safe

Never commit a key. Use your secret manager or CI variables.
Never put a key in client-side code. For a public status widget use a publishable embed key instead — that is what it is for.
One key per consumer. Separate keys for CI, your dashboard and your AI agent mean you can revoke one without breaking the others.
Review them periodically. Key creation, rotation and revocation are all recorded in the audit log.