mabl API keys enable programmatic access to the information in your mabl workspace. This guide covers how to create, manage, and rotate API keys. For help choosing a key type, see API key types below.
Access and scopes
API key access and usage is limited exclusively to workspace owners. For more information on scopes and permissions, see the article on API key types
Workspace API keys
You can create, pause, unpause, and delete API keys from the APIs page: Settings > APIs.
Creating API keys
To create an API key, workspace owners can navigate to Settings > APIs and take the following steps:
- Click on the + Create API key button to open the Create API Key modal.
- Select the type of API key.
- Give the API key a name.
- Optional: Check the Key expires checkbox and set an expiration time range between 1 and 365 days.
- Click on the Save button.
The new API key appears on the APIs page, where you can view, copy, pause, unpause, and delete the key as needed.
Note
You can only set an expiration date when creating a new API key. You cannot add an expiration date to an existing key.
Rotating API keys
Regularly rotating API keys reduces the risk of compromised credentials. If you set an expiration date when creating a key, the original key automatically stops working when it expires. mabl sends notification emails to workspace owners as the expiration date approaches on the following schedule:
- 7 days before expiration
- 3 days before expiration
- 1 day before expiration
- On the expiration date
Use these notifications as a prompt to rotate the key if it’s still needed, or to confirm that the key is safe to let expire. Once expired, the key stops working automatically. No manual action is required.
To rotate a key using expiration dates:
- Create a new API key of the same type, optionally with a new expiration date.
- Update the consuming integration with the new key value.
- Allow the original key to expire. No further action is needed.
If the original key doesn’t have an expiration date, you can manually disable it after confirming the new key works:
- Create a new API key of the same type.
- Update the consuming integration with the new API key value.
- Pause the original API key.
- Confirm that the integration works as expected with the new key.
- Delete the original, paused API key.
Pausing API keys
To temporarily disable an API key, toggle it off.
Unpausing API keys
Toggling an API key on instantly re-enables API access for the key.
Removing API keys
Click on the trash icon to permanently remove an API key.
Deleted API key cannot be recovered
Ensure an API key is no longer in use before deleting the key. Once deleted, an API key cannot be restored, meaning any impacted scripts and services will be unable to access mabl. If any clients are using this key, they will no longer be able to access mabl services.
If you are unsure whether any scripts or services are still accessing the API, try pausing the API key first.
Company API keys
Account admins can create user management API keys from the account dashboard.
Open the API keys tab and click on the Create key button. Give the key a name, set an expiration time range, and click Create key.
Copy the generated key and store it securely. You won’t be able to retrieve it again after this point.