API keys
Create a key for the REST API and the TypeScript SDK, pick its scopes, keep it safe, see where it's used, and revoke it. Included from the Maker plan.
An API key lets your own scripts and tools work with your workspace: list and read Things, change their parameters, build them, export STL, 3MF, STEP or DXF files, and run the agent. Keys are part of the Maker, Pro, Team and Enterprise plans.
Create a key
- Open Workspace → Developer (or ⌘K, API keys).
- Press Create API key and give it a name you'll recognise later, like "CI export script".
- Pick only the scopes it needs:
| Scope | Lets the key… | Needs |
|---|---|---|
things:read | List Things, read their docs, build them, read mass properties | any member |
things:write | Change a Thing's doc with ops (with version checks) | editor or above |
exports | Export files and list past exports | any member |
agent | Send prompts to the agent (uses the workspace's AI credits) | editor or above |
- Choose when it expires (7 days to a year, or never).
- Copy the key now. It is shown once. We store a fingerprint of it (a SHA-256 hash), not the key itself, so nobody, including us, can show it to you again. Lost it? Revoke it and create a new one.
Keys start with svk_. The first 12 characters (for example svk_a1B2c3D4) are its visible prefix: that's how you'll recognise it in lists and logs.
Keep it safe
- Treat a key like a password. Keep it in an environment variable or a secret store, never in a web page, a mobile app or a git repository.
- Give each script its own key, with only the scopes it needs. Then you can revoke one without breaking the others.
- A key acts as you in one workspace. If you leave the workspace, the key stops working. If your role drops below editor, its write and agent scopes stop working.
- Keys only work as an
Authorization: Bearerheader. The API never looks at your browser's sign-in, so another website can't use your session to call it.
See what it does
Under Recent API calls you see every call made with the workspace's keys (yours, or all of them if you're an admin): when, which endpoint, the result and the key's prefix. Each key also shows when and from where it was last used and how many calls it made. The log is kept for 90 days.
Changes made through the API show up in the open editor straight away ("Changed through the API · …") and in the Thing's history, like any other edit.
Limits
Each key may make a number of requests per minute that depends on the plan (60 on Maker, 120 on Pro, 300 on Team). Agent runs and exports have their own, lower limits. Over the limit, the API answers 429 with a Retry-After header; the TypeScript SDK waits and retries for you.
Revoke a key
Press Revoke next to it. Anything using it stops working immediately. Admins can revoke any key in the workspace.
Webhooks
Admins can add webhooks on the same page: an HTTPS address that receives a signed POST when something changes through the API (a doc update, a finished export, an agent proposal). The signing secret is shown once. Only public HTTPS addresses are accepted, and the address is checked again on every delivery. The REST API quickstart shows how to verify the signature.
Related
Did this help?
Keep reading
For CAD pros
REST API quickstart
Read a Thing, change a parameter with versioned ops, build it, read its mass and export an STL from your own script, with curl or the TypeScript SDK.
Pro6 min readFor CAD pros
Writing a custom feature
Make your own parametric smart feature in TypeScript, like FeatureScript: typed parameters become a dialog, build() adds recipe steps, and it runs sandboxed in the browser and on our servers.
Pro7 min readAccount and billing
Plugins and permissions
Add panels, ⌘K commands and custom features to the editor with plugins: what each permission means, how installs work, and why a plugin can never change your design behind your back.
Intermediate4 min read