API Keys
All API requests require an API key for authentication.
Creating an API Key
- Go to Settings > API Keys in your Plumi workspace
- Click Create API Key
- Give your key a descriptive name
- Copy the key (it won’t be shown again)
Store your API key securely. Never commit it to version control or expose it in client-side code.
Using Your API Key
Include your API key in the Authorization header:
curl -X GET "https://your-workspace.plumi.ai/api/connections" \
-H "Authorization: Bearer YOUR_API_KEY"
https://your-workspace.plumi.ai/sse?api_key=YOUR_API_KEY
API Key Permissions
API keys inherit the permissions of the user who created them:
- Read-only users can only execute SELECT queries
- Admin users have full access
Revoking API Keys
To revoke an API key:
- Go to Settings > API Keys
- Find the key you want to revoke
- Click Revoke
Revoke keys immediately if you suspect they’ve been compromised.
Best Practices
- Use separate keys for different integrations
- Rotate keys regularly (at least every 90 days)
- Use environment variables to store keys
- Never expose keys in client-side code or logs
Error Responses
401 Unauthorized
{
"success": false,
"error": "Invalid or missing API key"
}
403 Forbidden
{
"success": false,
"error": "Insufficient permissions"
}
