Skip to main content

API Key

Your workspace has a single server secret key (it starts with sk_). It authenticates every server-side call you make to Syft:

It is a workspace-level key, not a per-user one. Anyone with access to the workspace settings sees the same key.

Where to find it​

Go to Settings > Data Collection. The API Key card shows the key's prefix, when it was last rotated, and when it was last used.

Click Reveal to see the full key, then copy it.

Pro plan required

Viewing and using the API key requires the API Access feature, which is included in the Pro plan. On Starter the card shows an upgrade prompt instead of the key. See Credits & Usage.

Generating a key​

Every workspace is issued a key when it is created, so in most cases there is nothing to generate — just reveal the existing one.

If the card shows no key (older workspaces predate automatic issuing), click Generate key. The full key is shown once in a confirmation dialog. Copy it then; afterwards you can still reveal it from the same card.

Rotating a key​

Click Rotate on the API Key card. This mints a new key and invalidates the old one immediately.

Anything still using the old key stops working as soon as you rotate, so plan for it:

  1. Rotate the key and copy the new value from the dialog.
  2. Update every place the old key is stored — your server environment variables, your MCP client config, any scheduled jobs.
  3. Confirm your integrations are working again.

Using the key​

Pass it as a bearer token:

curl https://app.syftdata.com/api/motion/<motion-id>/export \
  -H "Authorization: Bearer sk_your_key_here"

Keeping it safe​

The key grants access to your workspace's data, so treat it like a password:

  • Store it in a secret manager or environment variable, never in client-side code or a public repository.
  • Do not paste it into shared documents or chat threads.
  • Rotate it if you think it has been exposed.

Ask Syft​

Ask Syft can bring the API Key card straight into the chat — ask "where is my API key?" or "how do I generate an API key?" and it will render the card with its reveal and copy controls. It will never print the key itself into a message.