API keys let you authenticate scripts and external tools against the AssetBolt API, separate from a person's login.
Find them under Settings → API keys.
Viewing and managing API keys are separate permissions:
Owners and Admins can create, rename, and revoke keys.
Technicians and Auditors can view the list of keys, but can't create, rename, or revoke them. They see a notice explaining that their role can only view keys.
See Roles and permissions for how roles map to permissions generally.
Click Create API Key and give it a name that describes what will use it, for example "CI/CD Pipeline". Names are required, can't be blank, and can't exceed 100 characters.
You can optionally set an expiration date. If you set one, it must be in the future, and the key stops working at the end of that day in your local time zone. Leave it blank for a key that never expires.
After you create a key, AssetBolt shows you the full secret value once. Copy it somewhere safe, since it can't be viewed again. Keys are shown afterward only as a prefix, like ab_live_…a1b2c3.
Owners and Admins can rename an existing key without rotating it, useful when what it's used for changes. Renaming doesn't affect the key's secret value or its expiration.
Revoking a key immediately and permanently disables it. Any script or tool still using it starts failing right away. Revoked keys are removed from the list, this can't be undone, so create a replacement key first if something depends on uninterrupted access.
Each key shows a status badge: Active or Expired, based on its expiration date. Expired keys stop authenticating but aren't automatically removed from the list, revoke them if you want them gone entirely.
Creating, renaming, and revoking a key are all recorded in the organization's audit log.
