Get the global API key
The account’s system-provisioned key, the one credential that works in every workspace.
The token comes back only to a stronger caller
Unlike workspace keys, this read can includespec.token, but only when the calling key’s scopes dominate the global key’s. A narrowly scoped caller gets the key without the token. That closes the loophole where a weak key reads the strong key’s credential and promotes itself; the rule is the same one covered in managing keys with keys.
Treat it as the break-glass credential
The global key holds full access across every workspace, which makes it the right bootstrap credential and the wrong daily driver. Mint workspace keys with narrow scopes for services, and keep the global key for provisioning and recovery. If its exposure ever worries you, the kill switch works while you rotate.Related
Rotate the global key
Disable the global key
Create an API key
API key scopes
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Response
OK
An API key. Every key belongs to exactly one workspace and is managed via the workspace-scoped API key routes. The only exception is the system-managed global account key, which spans all workspaces and is managed via the account global_api_key routes.
AccountResourceMetadata is used to represent a resource that is associated to an account but not to a workspace.
Configuration for an API key.
The current lifecycle state of the API key. Output only. Keys are created STATE_ENABLED; use the :disable and :enable actions to transition between states.
STATE_UNSPECIFIED, STATE_ENABLED, STATE_DISABLED