How to create and manage API keys

An API key is what identifies your organization when one of your systems calls the Strike Public API. Keys are created and managed from Settings → API Keys.

Before you start

• Keys belong to the organization, not to the person who created them, so they keep working when someone leaves the team

• A key gives read access to your organization's data, and only to that organization

• Anyone with the right role in your organization can see and manage every key

👉 Treat a key like a password: anyone who holds it can read your security data.

Creating a key

• Go to Settings → API Keys

• Click Create key

• Name it after where it will be used, for example "SIEM sync" or "Compliance dashboard"

• Optionally set an expiry date

• Copy the key and store it in your secrets manager

👉 The full key is shown once, at creation. Once you leave that screen it can't be retrieved again, only rotated.

What you can see about each key

• Its name and a short prefix, so you can tell keys apart without ever seeing the secret again

• When it was created, and when it expires, if it has an expiry

• When it was last used, the quickest way to spot a key nobody needs anymore

Rotating and revoking

• Rotate replaces the secret and shows you the new one once. The previous secret stops working immediately, so update the integration in the same session

• Revoke disables the key permanently. Any system still using it stops receiving data

👉 Rotate on a schedule, and revoke keys that show no recent use.

Good practice

• One key per integration, named after it, so you can rotate or revoke one without breaking the others

• Never commit a key to a repository or paste it into a shared document

• If a key may have been exposed, rotate it first and investigate afterwards