PeekPanda markpeekpandaDocumentationFor AI ↗Open app

PeekPanda docs

API keys

Create a named API key on the account desk, copy the secret once, and delete keys you no longer trust.

Download Markdown ↓

API keys live at the bottom of /account. Give a key a name, press Create key, and copy the secret immediately. It is shown once and never again.

Creating a key

  1. Open /account and scroll to API keys.
  2. Type a name. One to eighty characters, after trimming. The button stays disabled until you type something.
  3. Press Create key.

The new secret appears in a green panel headed Copy this once, with a Copy secret button next to it. The key also appears at the top of the table below.

The secret has two parts joined by a dot: a public identifier that starts with ppa_live_, and the secret itself. Send the whole string as a bearer credential.

The panel is the only place the full secret exists. Once you navigate away, delete the key and create another. There is no way to recover it.

Creating a key needs an active plan. Without one, the card reads Choose Peak or Panda to issue a key and there is no form.

The key table

Five columns. The section heading counts the active ones.

ColumnWhat it shows
NameThe name you gave it
KeyThe public identifier and the last four characters of the secret
CreatedThe date it was issued
Last usedThe date of its most recent call, Never if unused, Revoked if deleted
DeleteA two-step control

Newest keys sit at the top.

Deleting a key

Press Delete. The row swaps to Delete this key and Cancel, so a single misclick cannot revoke a live credential. Confirm and the key stops working immediately.

A deleted key is not removed from the table. It stays, greyed out, with Revoked in the Last used column and no delete control. That way the record of which credential was in use, and when it stopped, survives.

Scope

Keys belong to you, not to a workspace. The backend resolves the entitlement from the key itself. A browser-supplied actor id or tenancy header cannot grant access, and neither can a client-side flag.

The public API host, credential provisioning and OAuth consent flow are still rollout work and are not deployment verified. Read authentication before you build against them.

Related