Skip to main content
Open Settings → API to manage two workspace-scoped keys.

​
Choose the right key

  • Agent key (dk_agent_…): for AI Chat, MCP clients, and services reading from the public /v1 API.
  • Write key (dk_…): for server SDKs and supported server-side write flows.
These keys are secrets. Do not put either one in browser code. Client-side Web SDK setup uses the public workspace ID instead.

​
Generate a key

  1. Find the key type you need.
  2. Select Generate key.
  3. Confirm the action.
  4. Copy the full value from the one-time dialog.
  5. Store it in an environment variable or secret manager.
Datalyr only shows the full value once. After closing the dialog, the page displays a masked preview.

​
Rotate a key

Rotation invalidates the current key immediately.
  1. Identify every service using the current key.
  2. Select Regenerate and confirm.
  3. Copy the new value before closing the dialog.
  4. Update every dependent environment.
  5. deploy or restart those services.
  6. Verify one authenticated request.
There is no overlap period between old and new keys, so plan rotation when a brief coordinated update is safe.

​
If a key is exposed

Regenerate it immediately, update dependents, and review relevant service logs for unexpected use. Never send a full key to support; share only its prefix and masked ending when identifying which credential is involved.
Keys belong to the active workspace. A valid key from another workspace will not return or write the data you expected here.