Skip to main content
For the complete documentation index, see llms.txt.
API Keys allow you to access the VALAR API programmatically. Use them to integrate VALAR with your own systems, automate workflows, or build custom applications. Route: /settings

Page Layout

The API Keys section is located in the Settings page. It displays all your organization’s API keys in a table with management actions. Api Key

API Keys Table

The table shows all API keys for your organization:

Actions Menu

Click the three-dot menu on any row to access these actions:

Creating an API Key

Click Create API Key to open the creation dialog. This is a two-step process.

Step 1: Configure Key Settings

Expiration Options:
  • 1 Day
  • 1 Week
  • 1 Month
  • 3 Months
  • 1 Year
  • No Expiry
IP Allowlist: Restrict which IP addresses can use this key. Enter individual IPs or CIDR ranges (e.g., 192.168.1.1 or 10.0.0.0/24). Maximum 50 entries. Leave empty to allow all IPs.

Step 2: Copy Your Key

After clicking Create Key, your new API key is displayed.
Important: This is the only time you will see the full API key. Copy it immediately and store it securely. You cannot retrieve it later.
  • Use the copy button to copy the key to your clipboard
  • Use the eye icon to show/hide the key value
  • Click Done when you’ve saved the key

Editing an API Key

Click Edit from the actions menu to modify an existing key.
Changing status to Revoked immediately stops all API access using this key. Applications will receive authentication errors until the key is re-enabled.

Rotating an API Key

Rotation generates a new secret value for the key while keeping the same name and settings. Use this to periodically refresh credentials or if you suspect a key may be compromised. To rotate a key:
  1. Click Rotate from the actions menu
  2. Type the key name to confirm
  3. Click Rotate Key
  4. Copy the new key value (shown only once)
The old key is immediately invalidated when you rotate. Update your applications with the new key before they attempt to make API requests.

Deleting an API Key

Permanently remove an API key when it’s no longer needed. To delete a key:
  1. Click Delete from the actions menu
  2. Type the key name to confirm
  3. Click Delete Key
Deletion is permanent and cannot be undone. All applications using this key will immediately lose access.

Viewing Audit Logs

The audit log shows all API requests made with a specific key. Use it to monitor usage, troubleshoot issues, or investigate security concerns. Click View Audit Log from the actions menu to open the dialog. Navigation:
  • Click Refresh to fetch the latest logs
  • Use Previous/Next buttons to navigate through pages

Security Best Practices

Follow these guidelines to keep your API keys secure:

Using Your API Key

Include your API key in the Authorization header using the Bearer scheme:
All API keys use the vsp_sk_ prefix to identify them as VALAR Space secret keys.

Workspace access

Without an X-Workspace-Id header, requests target the permanent default workspace. Selecting a different workspace in the browser does not change this target, including when you create a key. To use an additional workspace, the key needs an explicit grant for that workspace within the same organization. Your own workspace membership does not give the key access. There is currently no workspace-grant control in the API Keys UI; ask your organization administrator to coordinate access with VALAR support. Do not share the secret key. See Connect integrations to a workspace for where to find the workspace UUID and how to send it on requests. Existing integration bindings remain unchanged. The API’s retained environment field defaults to OPERATIONS and is immutable; it is not a workspace selector. Another organization, invalid UUID or inaccessible workspace is rejected rather than redirected to a different target.

Limits

For request quotas, concurrent job limits, and handling HTTP 429 responses, see API rate limits.