Skip to main content
All API requests require authentication using API keys.

​
Getting an API Key

1

Go to Settings

Navigate to Settings in the sidebar.
2

Select API Keys

Click the API Keys tab.
3

Create Key

Click Create API Key.
4

Name Your Key

Give your key a descriptive name (e.g., “Production Server”, “CI/CD Pipeline”).
5

Copy Key

Copy the key immediately. It won’t be shown again.
API keys are shown only once at creation. Store them securely.

​
Using API Keys

Include your API key in the Authorization header: 
curl https://api.certwatch.app/v1/certificates \
  -H "Authorization: Bearer ck_live_abc123..."

​
Key Types

PrefixTypeDescription
ck_live_ProductionFull access to your organization
ck_test_TestFor development and testing

​
Key Permissions

API keys have the same permissions as the user who created them:
  • Owner/Admin keys: Full API access
  • Member keys: Read-only access

​
Security Best Practices

  1. Never commit keys to version control 
    # Use environment variables
export CERTWATCH_API_KEY="ck_live_..."
  2. Rotate keys regularly
    • Create a new key
    • Update your applications
    • Delete the old key
  3. Use separate keys per environment
    • Production key for production
    • Test key for development/staging
  4. Limit key exposure
    • Don’t share keys in Slack/email
    • Use secrets management (AWS Secrets Manager, HashiCorp Vault)

​
Revoking Keys

To revoke an API key:
  1. Go to Settings → API Keys
  2. Find the key
  3. Click Revoke
  4. Confirm revocation
Revoked keys immediately stop working.

​
Rate Limiting

Rate limits are per API key: 
HTTP/1.1 429 Too Many Requests
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1704067200
Retry-After: 30
Wait until X-RateLimit-Reset or the Retry-After seconds before retrying.

​
Errors

​
Invalid Key

{
  "error": {
    "code": "invalid_api_key",
    "message": "The provided API key is invalid"
  }
}

​
Expired Key

{
  "error": {
    "code": "expired_api_key",
    "message": "This API key has been revoked"
  }
}

​
Missing Key

{
  "error": {
    "code": "missing_api_key",
    "message": "No API key provided. Include Authorization header."
  }
}