Reference: API keys
The format of a project API key, how keys are created, listed, and revoked, and how to send them in the Authorization header.
Key format
API keys use the format qbly_<lookupId>_<secret>. They consist of a fixed prefix, a public 6-byte lookup ID, and a 32-byte secret token. Qably stores only the SHA-256 hash and performs constant-time comparisons. The plaintext token cannot be retrieved once issued.
Create, list and revoke
| Action | Endpoint | Role required |
|---|---|---|
| List keys | GET /projects/:projectId/api-keys | Any organization member |
| Create a key | POST /projects/:projectId/api-keys (body: { "name": string }) | owner or admin |
| Revoke a key | POST /projects/:projectId/api-keys/:id/revoke | owner or admin |
Revoking and sending keys
Revoked keys are preserved in the database to maintain attribution for past test runs. Transmit the key via Authorization: Bearer qbly_<lookupId>_<secret>.