Skip to content
PeriplusDocs
Open app
Personal API keys

Personal API keys

Authenticate your own code with your current organization access.

Create and store a key

A personal key belongs to you and one organization and authenticates the REST API and Python SDK. Its fixed Developer profile is intersected with your current role. API keys do not authenticate to MCP; AI clients sign in with OAuth instead. The app, SDK, API, and MCP share one organization allowance under Settings → Budgets.

  1. Switch to the organization your code should use.
  2. Open Access → SDK & API, choose Create API key, give it a recognizable name, and optionally set an expiry.
  3. Copy the secret when it is shown and store it in an environment variable or secret manager. You cannot reveal it again later.

Keep keys private

Use a separate named key for each integration so you can revoke one without disrupting the others. Never share a personal key with teammates or ship it in frontend code. Each teammate should create their own.

If a key is exposed, revoke it and create a replacement. Revocation blocks subsequent authentication; it does not undo work already submitted. SDK & API access shows only your own keys in the current organization. Use the trash button beside a revoked key and confirm Delete key to remove it from the list; audit and usage history remain. Active keys must be revoked first.

If authentication fails

Check the API origin, Bearer header, selected organization, and whether the key has been revoked. Access also depends on your current membership and role. An invalid key prevents sign-in; insufficient permissions prevent a particular action.

Manage your keys

Keys inherit your current organization access. The API lists and revokes only your own keys. Create returns a secret once; the SDK masks it in object representations. Read secret.get_secret_value() only when storing it securely.

Python

Python
from periplus_sdk import Client

with Client() as client:
    for key in client.api_keys.iter():
        print(key.id, key.name, key.revoked_at)

cURL

Shell
curl --fail-with-body "${PERIPLUS_API_URL:-https://api.periplus.dev}/api-keys?limit=20" \
  -H "Authorization: Bearer $PERIPLUS_API_KEY"

Open SDK & API access