Skip to main content
GET
JavaScript
Every account gets exactly one global key, created by the system. It spans all workspaces, cannot be deleted, and lives on the account rather than in any workspace key list. This endpoint takes no ID because there is nothing to choose.

The token comes back only to a stronger caller

Unlike workspace keys, this read can include spec.token, but only when the calling key’s scopes dominate the global key’s. A narrowly scoped caller gets the key without the token. That closes the loophole where a weak key reads the strong key’s credential and promotes itself; the rule is the same one covered in managing keys with keys.

Treat it as the break-glass credential

The global key holds full access across every workspace, which makes it the right bootstrap credential and the wrong daily driver. Mint workspace keys with narrow scopes for services, and keep the global key for provisioning and recovery. If its exposure ever worries you, the kill switch works while you rotate.

Rotate the global key

New token, all previous ones invalidated.

Disable the global key

The account-wide kill switch.

Create an API key

The scoped keys you should be using instead.

API key scopes

What scope dominance means, precisely.

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Response

OK

An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.

metadata
object
required

AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.

spec
object
required

Configuration for an API key.

state
enum<string>
required
read-only

The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.

Available options:
STATE_UNSPECIFIED,
STATE_ENABLED,
STATE_DISABLED
info
object