Skip to main content

API Keys

API keys are the credentials you use to authenticate requests to the Perspective External API. This page explains where to get a key, how to keep it safe, and what to do if it is compromised.

Obtaining an API key​

  1. Sign in to Perspective with an Admin account. API key creation is restricted to Admins — non-admin users cannot create keys.
  2. Open Account Settings.
  3. Find the API Keys section and create a new key.
  4. Copy the key immediately and store it securely. You will not be able to view the full key again after this step.

Security guidelines​

API keys grant programmatic access to your Perspective data. Treat them with the same care as passwords.

Do:

  • Store keys in environment variables, a secrets manager (e.g. AWS Secrets Manager, HashiCorp Vault), or a CI/CD secrets store.
  • Restrict which services and team members can access a given key.
  • Rotate keys on a regular schedule or immediately after any suspected exposure.

Don't:

  • Commit keys to source control — not even in private repositories.
  • Include keys in client-side JavaScript, mobile app bundles, or any code that runs in a user's browser or device.
  • Share keys over email or chat.

Rotating a key​

If a key is compromised or you want to rotate it for security hygiene:

  1. Return to Account Settings and create a new key.
  2. Update every service, environment variable, and secrets store to use the new key.
  3. Once all services are using the new key, revoke the old key.

Plan rotations carefully: any service still using an old key will start receiving 401 Unauthorized errors as soon as that key is revoked.

  • Authentication — how to send your key on each request
  • Errors — what the API returns when a key is missing, invalid, or lacks permissions