Skip to main content

API Keys

Updated

Use an API key for scripts, servers, and scheduled jobs that run without browser sign-in. For an interactive terminal session, you can use CLI browser login instead.

Create a Key

  1. Open Settings > Developer > API keys.
  2. Click Create key.
  3. Enter a Key name that identifies the job, such as Monthly client reports.
  4. Choose an expiration: 30 days, 90 days, 1 year, or No expiry.
  5. Select the workspaces the job needs.
  6. Create the key.

Settings, Developer, API keys

Create API key

Key name

e.g. CI Bot, Zapier, n8n

Expiration

30 days90 days1 yearNo expiry

Workspace access

1 of 4

Brie PatisserieNorthside DentalHarbour GymMaeve Social
CancelCreate key

  • 90 days is the default

    Leave it alone and the key stops working in three months. No expiry is the choice for anything that has to keep running.

  • One workspace is pre-ticked

    The one you are in. A key for one client's reporting job should carry that client and nothing else.

  • There is no edit later

    Name, expiry and workspaces are fixed once the key exists. Changing any of them means a new key.

The create dialog. Expiration is a required choice with 90 days pre-selected, and the workspace you are standing in is already ticked, so both are worth changing on purpose rather than leaving as found.

The default expiration is 90 days, and the current workspace starts selected. Check both before creating the key. The name can contain up to 255 characters.

Your roleWorkspaces you can grant
Organization Owner or AdminAny workspace in that organization
Workspace ManagerWorkspaces you manage

Copy and Store the Key

  1. Copy the key from the reveal dialog.
  2. Store it in your password manager or automation service's secret storage.
  3. Click Done after you have saved it.

Key created

Key created

Copy your key nowThis is the only time the full key will be shown. Store it securely. You won't be able to see it again.

Your API key

ezb_live_4f9c2a17b83e5d06c1a94f2e7b3d8016a5c7e9f2d4b16803
Done

Escape and clicking outside are both blocked while this is open.

The key is on screen once. After Done, the list keeps the first 16 characters, when it was made, when it was last used and when it lapses, and nothing else. There is no way back to the rest of it.

For CLI automation, configure your secret storage to provide the key as the MAEVE_API_KEY environment variable. For direct API requests, read the secret in your server code and send it in the Authorization: Bearer header.

Keep the key out of source control, URLs, browser-side code, and chat messages. Entering a secret directly in a shell command can also save it in shell history.

Check Workspace Access

A key can access only its selected workspaces. It also depends on the access of the person who created it. A request outside its workspace grants returns a permission error even if that person can open the workspace in Maeve.

Create separate keys for unrelated jobs so you can revoke one without stopping the others. Jobs sharing a key also share its rate limits.

API keys cannot create, list, or revoke other API keys. Manage keys through your signed-in browser session in Settings.

Replace a Key

You cannot edit a key's name, expiration, or workspace grants after creation. To change them:

  1. Create a new key with the settings you need.
  2. Update the job's stored secret.
  3. Check that the job works with the replacement.
  4. Revoke the old key.

There is a limit of ten unrevoked keys per organization. Expired keys still count toward that limit, so revoke keys you no longer use.

If a Key Stops Working

CauseWhat to do
The key expiredCreate a replacement, update the job, and revoke the expired key
The key was revokedCreate and configure a replacement if the job still needs access
The creator lost required accessHave an eligible member create a replacement
The workspace is outside the key's grantsUse a key that includes the intended workspace

Maeve checks the creator's access when the key is used. The key is revoked if they leave or are disabled in the organization, become a Finance user, or no longer manage every granted workspace without organization Admin or Owner access.

Revoke a Key

  1. Open Settings > Developer > API keys.
  2. Find the key and click its delete icon.
  3. Confirm Revoke key.

Revocation takes effect immediately and cannot be undone. Record the key's workspace grants first if you need them for an audit, because revocation clears those grants.

Questions

When should I use an API key instead of signing in?

Use an API key for unattended scripts, servers, and scheduled jobs. Use CLI browser login for an interactive terminal session.

Where do I create an API key?

Open Settings > Developer > API keys and click Create key.

Does a key expire?

The default is 90 days. You can select 30 days, 90 days, 1 year, or No expiry when creating it.

Can I see a key again after creating it?

No. Copy and store it before clicking Done. If you lose it, create a replacement and revoke the old key.

Can I rename a key or change its workspaces later?

No. Create a replacement with the new settings, update your automation, and revoke the old key.

What can a key reach?

Only its granted workspaces, subject to the creator's permissions and the organization's plan. It cannot manage other API keys.

What happens if the person who made a key leaves?

The key is permanently revoked when it is used after the creator loses required access. Review their automation before changing team access.

How many keys can we have?

Ten unrevoked keys per organization. Expired keys count until you revoke them.

Where should I store a key?

Use a password manager or your automation service's secret storage. Supply it to the CLI through an environment variable such as MAEVE_API_KEY.

Should several jobs share one key?

Separate keys let you revoke one job without stopping the others. Jobs using the same key share its rate limits.

Can I undo revoking a key?

No. Create a new key if access is needed again.

Bring It All Into One Place

Start Your 3-Day Free Trial