How to create and manage API keys

An API key identifies your organization when one of your systems calls Strike's Public API. Keys are created and managed from Settings → API Keys.

Before you start

• Keys belong to the organization, not to the person who created them, so they keep working when someone leaves the team.

• A key gives read access to your organization's data, and only to that organization.

• Anyone with the corresponding role in your organization can view and manage all keys.

Treat a key like a password: anyone who has it can read your security data.

Create a key

1. Go to Settings → API Keys.

2. Click Create key.

3. Give it a name that indicates where it will be used, for example "Sync SIEM" or "Compliance dashboard".

4. If you want, set an expiration date.

5. Copy the key and store it in your secrets manager.

Important: the full key is shown only once, when you create it. Once you leave that screen, it can no longer be retrieved, only rotated.

What you can see for each key

• Its name and a short prefix, to tell one key from another without seeing the secret again.

• When it was created and when it expires, if it has an expiration date.

• When it was last used. This is the fastest way to spot a key that nobody needs anymore.

Rotate and revoke

• Rotate replaces the secret and shows you the new one only once. The previous secret stops working immediately, so update the integration in the same session.

• Revoke permanently disables the key. Any system that still uses it stops receiving data.

Rotate keys on a defined schedule and revoke the ones with no recent use.

Best practices

• Use one key per integration, named after that integration, so you can rotate or revoke it without breaking the others.

• Never commit a key to a repository or paste it into a shared document.

• If a key may have been exposed, rotate it first and investigate afterward.

To see what data you can read with the API, see What you can do with Strike's Public API.