Security4 min read•Audience: Developers
Authentication & API Keys
Generate secure API keys, manage workspace permissions, handle key rotation, and troubleshoot 401 Unauthorized errors.
Key Takeaways
- Generate API keys from Settings → Developers in the PostBrix dashboard.
- API keys start with the pb_live_ prefix.
- Pass keys in the Authorization: Bearer <key> header.
- Never expose API keys in client-side code or public GitHub repositories.
Generating an API Key#
- In the PostBrix dashboard, open Settings → Developers.
- Click Create API Key.
- Provide a descriptive label (e.g.,
Production Billing Service). - Copy the secret key immediately. Keys are hashed with SHA-256 upon storage and cannot be displayed again.
API Key Security Best Practices#
To ensure workspace integrity:
- Server-Side Only: Never call the PostBrix API directly from browser JavaScript or mobile mobile clients where keys can be extracted.
- Environment Variables: Store keys in
.env.localor your cloud secrets manager (AWS Secrets Manager, Doppler, Vault). - Zero-Downtime Key Rotation: When rotating keys, generate a new key first, update your production environment variables, and verify traffic before deleting the retired key.
Frequently Asked Questions
What do I do if an API key is accidentally committed to GitHub?
Immediately delete the key from Settings → Developers in the PostBrix dashboard. This instantly revokes access, and any calls using that key will return 401 Unauthorized.
Can I restrict an API key to specific IP addresses?
Enterprise plans support IP whitelisting to restrict API key usage to authorized production CIDR blocks.