Overview
API keys allow scripts, automations, and third-party tools to authenticate with The One Stack on behalf of your organization. This article covers creating keys, choosing scopes, revoking keys, and using them with Bridge.
Creating an API Key
- Go to Settings → API Keys (
/settings/api-keys). - Click New API key.
- Enter a name that describes what the key is for (for example, "Billing script" or "PSA automation").
- Select the permissions (scopes) the key should have. Permissions are listed by product and action — only grant what the integration actually needs.
- Optionally, set an expiry date. Keys with no expiry remain active until manually revoked.
- Click Create.
- The full key is shown once on screen. Copy it immediately and store it in a password manager or secrets vault. You cannot view the full key again after leaving this page.
API key values begin with theone_apikey_.
Scopes
Scopes define what an API key is allowed to do. They follow the same permission structure as user roles — each scope maps to a specific product and action (for example, psa.ticket.create or rmm.device.read).
When creating a key, select only the permissions required for the integration. A key with broad permissions is a larger security risk if it is ever exposed.
Revoking a Key
To permanently disable an API key:
- Go to Settings → API Keys.
- Find the key in the list and click the ... menu.
- Click Revoke.
- Confirm the revocation.
Revoked keys stop working immediately. The action is logged in the audit log.
If you suspect a key has been compromised, revoke it immediately and create a replacement.
Using API Keys with Bridge
The One Bridge (bridge.theonestack.com) is where you connect API keys to external integrations and automations. The Hub Settings → API Keys page is the source for key creation and management; Bridge uses those keys to authenticate outbound calls to your integrations.
To use a key in Bridge:
- Create the key in Settings → API Keys with the relevant permissions.
- Copy the key value.
- In Bridge, add a new integration and paste the key when prompted for an API key.
Frequently Asked Questions
I forgot to copy my key when it was shown. What do I do?
You cannot retrieve the full key value after creation. Revoke the key and create a new one.
Do API keys expire automatically?
Only if you set an expiry date when creating the key. Keys without an expiry date remain active until you revoke them.
Can an API key trigger anything that a human admin can do?
An API key has exactly the permissions you assigned to it — no more. A key scoped to read-only billing data cannot create users or modify settings.
Where can I see when a key was last used?
The API Keys list shows a Last used timestamp for each key. This updates each time the key is used to make an authenticated request.
Can I have multiple API keys?
Yes. Create as many as you need. It is a best practice to use a separate key for each integration so you can revoke one without affecting others.