Skip to main content
API keys are how you authenticate in development. Each key is tied to a workspace and environment, so you always know what it can access. Generate one in the Console, pass it to the SDK, and you’re making authenticated requests in seconds. An API key is the fastest way to authenticate to Hexel Studio. It is ideal for development, scripts, and testing. API keys are created under service users in the Console.

​
How it works

Create a service user and generate an API key under IAM → Service Users. The key is scoped to a workspace and environment. When you use it, the platform sends it to the STS (sts.hexelstudio.com) which returns a short-lived Bearer token (valid 15 minutes, refresh token valid 30 days). The SDKs handle this exchange and refresh automatically.

​
Getting started

  1. In the Console, go to IAM → Service Users.
  2. Create a service user and generate an API key.
  3. Provide the key to a client:
Or set it as an environment variable:

​
Security

​
Common mistakes

  • Committing keys to version control. Use environment variables or a secret manager.
  • One key for all environments. Use a separate key per environment.
  • Using API keys in production services. Prefer service accounts with OAuth client credentials.

​
Best practices

  • Rotate keys periodically and immediately if exposed.
  • Scope each key to the narrowest workspace and environment needed.
  • Never embed keys in client-side or mobile code.

​
Key rotation procedure

Zero-downtime rotation requires overlapping validity — the old key must work until all consumers have switched.
1

Create a new key

In IAM → Service Users, generate a new API key for the same service user, workspace, and environment. Both old and new keys are now valid simultaneously.
2

Update all consumers

Deploy the new key to every service, CI pipeline, and developer environment that uses the old key. Update secret managers, environment variables, and configuration files.
3

Verify traffic on the new key

Monitor logs to confirm requests are authenticating with the new key. Wait at least one full deployment cycle to ensure no consumer still uses the old key.
4

Revoke the old key

In IAM → Service Users, revoke the old key. Revocation takes effect immediately for new token exchanges — any already-issued access token remains valid until its 15-minute expiry.
Schedule rotation on a regular cadence (e.g., every 90 days) rather than waiting for a suspected compromise. Automating steps 1–3 via your secret manager’s rotation hooks removes the manual burden.

Service Accounts

OAuth credentials for production.

Authentication

How keys become tokens.

Environments

Scope keys per environment.

Members & Roles

Control who can create keys.