Skip to main content
Create a key for CI or a server:
Store the secret as BOAT_API_KEY. Send it as a bearer token:
  • A new key starts with boat_. Older keys start with box_ and still work.
  • Every new key expires. The maximum is 365 days.
  • Every new key has a scope. boat checks it on each request.
  • A key acts as you. It is either an organization key or an account key.
The dashboard lists the keys of the selected organization. Personal lists the account keys.
A key leaked? Revoke it now. Read Key leaked.
Treat API keys as secrets. Do not commit them, print them in logs or put them into images.

​
Main task

  1. Create a key with the smallest scope that does the job.
  2. Store it as BOAT_API_KEY in your platform secret manager.
  3. Use it from the CLI, the API or an SDK.
  4. Rotate or revoke it when you need to.

​
Production guidance

  • Use one key per job.
  • Use the shortest TTL that works for you.
  • Use read-only or ci. A key with no --preset and no --actions is an admin key.
  • Limit a key to sandboxes or environments with --sandbox or --env when you can.
  • For keys inside your end users’ sandboxes, read Security for platforms.

​
Learn more

Scopes

Actions, presets, the in-sandbox API key and scope errors.

Create and list keys

Create a key, use it, list your keys and see the usage of one key.

Store, rotate and revoke

Revoke a leaked key, store a key and replace its secret.
Keys created before scoped keys existed have no expiry and full access. Replace them with new scoped keys. boat api-key list shows them with no expiry.