Create an API key
Only team members with the Owner or Admin role can create an API key in your organization.
Choosing the right scope
Project-scoped API keys
Project-scoped API keys are limited to a single project and are designed for setups where projects must remain clearly separated. They work best for agencies and larger organizations, where each project is owned by a different team.- Access is restricted to one specific project
- Cannot create or manage other projects
- No additional project headers are required when making API requests
Organization-scoped API keys
Organization-scoped API keys provide access across all projects in an organization and allow full project management. They are well suited for small teams, startups, and infrastructure provisioning.- Access to all projects in the organization
- Can create and manage projects
- Requires a project selection header on most requests
Product scopes
Product scopes lets you restrict which parts of the Phare platform an API key can access. This helps apply the principle of least privilege and limits what a key can do if it is misused. Each API key can be configured per product with one of the following access levels:- No access
- Read-only
- Read-write
You can create as many keys as necessary to fit your use case.
Authentication
The Phare API uses Bearer Token Authentication to secure access to its endpoints. To authenticate your requests, include the API key in the Authorization header of your HTTP requests:Project selection
If you’re using an organization-scoped API key, every endpoint except/projects most endpoints will require you to add an HTTP header to specify which project to operate on. You can specify the project by its ID or Slug:
- X-Phare-Project-Id: The project’s numeric ID
- X-Phare-Project-Slug: The project’s slug
Rate limiting
Access to the API is currently rate limited to 100 calls per minute across the organization. All API keys share the same limit.Security
Never share your API key publicly. If you suspect that your API key has been compromised, revoke it immediately through your control panel and generate a new one.If an API endpoint is missing or a custom rate limit is needed, contact support. Phare can help find a solution that fits the use case.