Create and scope an API key | Topolab Help Center

Requires: a signed-in Topolab account. Creating shared organization keys additionally needs the APIKEY_CREATE permission on that organization.

Create a key

Open /portal/developer and create a key, or call the API directly with a Bearer token. Keys use the format tlb_{env}_{32 chars}, for example tlb_prod_3f9a2c7e8b1d4056a1c2e3f4a5b6c7d8. The secret is returned once in the create response and is never retrievable afterward, so store it immediately.

curl -X POST \
  -H "Authorization: Bearer eyJhbGci..." \
  -H "Content-Type: application/json" \
  -d '{"name":"etl-nightly","permissions":["read"],"expiresAt":"2026-12-31T23:59:59Z"}' \
  "https://api.topolab.nl/v1/api-keys/personal"

Scopes and permissions
Keys carry a scope (user, organization, or platform) and permissions. Data access needs the read permission on the relevant resource. Use organization keys for shared or server workloads and personal keys for individual work.

Rotate and revoke

Rotation issues a new secret and revokes the old one immediately — any client still using the old secret starts receiving 401, so update your deployment first. Use revoke to disable a key while keeping its history, or delete to remove it entirely.

curl -X POST \
  -H "Authorization: Bearer eyJhbGci..." \
  "https://api.topolab.nl/v1/api-keys/key_9a2c7e8b/rotate"