API Keys
All API requests require an API key for authentication.
Creating an API Key
- Go to Settings > API Keys in your Plumi workspace
- Click Create API Key
- Give your key a descriptive name
- Copy the key (it won’t be shown again)
Store your API key securely. Never commit it to version control or expose it in client-side code.
Using Your API Key
Include your API key in the Authorization header:
Or as a query parameter (for MCP connections):
API Key Permissions
API keys inherit the permissions of the user who created them:
- Read-only users can only execute SELECT queries
- Admin users have full access
Revoking API Keys
To revoke an API key:
- Go to Settings > API Keys
- Find the key you want to revoke
- Click Revoke
Revoke keys immediately if you suspect they’ve been compromised.
Best Practices
- Use separate keys for different integrations
- Rotate keys regularly (at least every 90 days)
- Use environment variables to store keys
- Never expose keys in client-side code or logs
Error Responses
401 Unauthorized
The API key is missing, invalid, or has been revoked.
403 Forbidden
The API key doesn’t have permission for this operation.
