API Keys
API keys let external tools authenticate with OWOX Data Marts without an interactive browser session.
Use API keys with:
- owox-ctl
- @owox/api-client
- CI and automation scripts
- local agents
- custom scripts and internal tools
Each API key has two parts:
- API key ID
- API key secret
The API key secret is shown only when the key is created. Store it securely.
API keys are associated with project access. Available data and actions depend on the permissions granted to the project member who owns the key.
Create an API key
Section titled “Create an API key”- Open your OWOX Data Marts project.
- In the project menu, open Project settings → My API Keys.
- Click Create API Key.
- Enter a Name.
- Optionally set Expires (optional).
- Click Create.
- In the API Key Created dialog, copy the API Key ID and API Key Secret.
- Store the API key secret securely.
- Click I have saved the secret.
The API key secret is shown only once.
Do not share API key secrets in chat, email, screenshots, support tickets, prompts, or repository files.
Use an API key
Section titled “Use an API key”After creating an API key, use it with one of the supported API access options:
- owox-ctl for terminal, CI, automation, and local agent workflows.
- @owox/api-client for TypeScript or JavaScript integrations.
- OpenAPI and Swagger UI for inspecting the raw HTTP API contract.
Revoke or rotate API keys
Section titled “Revoke or rotate API keys”- Open Project settings → My API Keys.
- Find the API key.
- Open the row actions menu.
- Click Revoke.
- In the Revoke API Key dialog, click Revoke.
After an API key is revoked, tools using that key can no longer authenticate.
Rotate a key by creating a new API key, updating the tool or automation that uses it, and revoking the old key.
Security recommendations
Section titled “Security recommendations”- Create separate API keys for different users, tools, or automation contexts.
- Do not commit API key secrets to Git.
- Do not store API key secrets in prompts, agent instruction files, screenshots, or support tickets.
- Prefer environment variables or secret managers for CI and local agents.
- Revoke keys that are no longer used.
- Rotate keys if the secret may have been exposed.