API keys guide

FastStaq lets your users (and you) create programmatic API keys to access the platform from scripts and integrations, with security handled for you.

Creating a key

1. Open the API keys section in the dashboard.
2. Create a key with a name and the scopes it needs.
3. Copy the key immediately. It is shown once at creation and cannot be retrieved later.

How keys are secured

• Keys are hashed at rest with a server-side pepper (API_KEY_PEPPER), so a database leak does not expose usable keys.
• Each request is authenticated by matching the presented key against the stored hash.
• Use scopes to grant the minimum access an integration needs.

Using a key

Send the key on each request as documented in your API (typically an Authorization header or x-api-key). Treat keys like passwords: never commit them to source control or expose them in client-side code.

Rate limits

API access is rate-limited per window (RATE_LIMIT_*, RATE_LIMIT_WINDOW_MS). Design integrations to back off and retry on a 429.

Auditing

Key usage can be sampled into the audit log (AUDIT_API_KEY_SAMPLE_RATE, default 1 in 20) so high-volume integrations do not flood the audit table while still leaving signal for incident response. Set it to 1 during an investigation.

Rotating and revoking

• Rotate by creating a new key, switching your integration to it, then deleting the old one.
• Revoke a compromised key immediately; revoked keys stop working at once.

Related articles

• Outbound webhooks guide
• Roles and permissions (RBAC)

Still need help?

Open a support ticket for API integration help.