API keys
Create and revoke API keys for programmatic and CI access to Relay.
API keys provide programmatic access to Relay for automation, CI, and integrations — an alternative to an interactive sign-in.
Create and revoke keys from Organization → API keys in the dashboard, or from
a workspace's own API keys page. Only admin and owner hold the
org.api_keys.* permissions, so members and viewers do not see the page.
Role, scope, expiry, and source addresses
Each key has its own settings, chosen when you create it:
- Role — the role the key acts with (the dashboard defaults to
viewer). A key is not a copy of its creator's permissions. You can only pick a role whose permissions you hold yourself, and a key can never hold an owner-level role. - Scope — an organization-wide key, or a key limited to one workspace.
- Expiration — the dashboard defaults to 90 days.
- Allowed source CIDRs — optionally restrict the key to requests from specific address ranges.
An API key's secret is shown once, at creation. Copy it immediately and store it in a secret manager — it can't be retrieved again. Revoke a key the moment it's no longer needed or may be exposed.
Give keys the narrowest role that does the job. Creating,
updating and revoking a key is recorded in the activity log,
and so are changes made with a key (the actor shows as api-key:<name>).
Read-only requests made with a key are not logged.