API keys
API keys
Servers, scripts and automations authenticate to the Twelfth REST API
with a bearer key. Owners and admins create and revoke workspace keys from
Settings → AI & agents. Keep keys secret and use them only from server-side
code.
Create a key
Select Create an API key, name it, and tag the environment it serves:
Development, Staging or Production. Twelfth shows a newly created key
only once: copy it immediately.
Use Create an API key for a cron job, a script or your own backend. The
public REST API uses the key to identify its workspace; every valid workspace
key can read GET /workspace and the workspace-wide current list from
GET /tasks.
One key per thing
Give every device, server and automation its own key. It costs nothing, and it
is the difference between revoking one stale laptop and taking production down
with it. Each row shows the key’s prefix, when it was last used, its activity
over the last twelve weeks, and, once it has connected, the client and version
on the other end. A row that reports more than one client is a key being shared;
split it.
Rename a connection or change its environment from the row’s menu at any time.
Neither reissues the secret, so nothing that is already connected breaks.
Revoke a key immediately if a device is lost, a team member no longer needs the connection, or you suspect the key was exposed. Revocation stops every API or automation request using that key at once.
Related
- Developer API: authenticate and make the first REST request
- API reference: supported operations and schemas
- API compatibility: stable, unversioned paths