Rowan Docs

API Keys

You can use Rowan's web interface to manage credentials for Rowan's Python API. Each API key can have its own expiration date, permission scope, and project restriction.

Create a new API key

Navigate to "Account" → "API Keys", or open the API keys page directly, and click "Create API key."

Configure the key using the fields in the creation window:

  • Name: Choose a descriptive name to identify the key.
  • Expires on (expires_at): Use the date selector to give the key the shortest practical lifetime. A session key should not remain valid long after its session ends.
  • Scope: Choose full access (read, write, and delete), read and write, or read only.
  • Project: Restrict the key to one project, or leave it set to all projects.
  • Credit budget: Set the maximum number of credits the key can use, or leave this field blank for no key-specific limit.

Click "Create." The window will display a generated API key beginning with rowan-sk.

The plaintext key is shown only once and cannot be retrieved later. Copy it directly to your secrets manager or intended runtime. If you lose it, revoke it and create a replacement.

There is no limit to the number of API keys one user can generate.

View usage and edit a credit budget

The Credit usage column shows each key's usage alongside its budget, or Unlimited when no budget is set. To change a budget, use the key's Edit budget button, enter the new credit budget, and click Save. Leave the field blank to remove the key-specific limit. Credit budgets are also available when creating a master API key.

Scopes and project restrictions

Choose the least-permissive scope that supports your purpose:

  • Full access permits reading, writing, and deleting.
  • Read and write permits reading and creating or updating data, but not deleting it.
  • Read only permits retrieving data without modifying it.

A project-scoped key cannot access data outside its selected project, even when the key's owner can access other projects. Use project scoping to isolate end users, integrations, agents, or individual sessions.

Master API keys

A master API key can create, list, and revoke other API keys programmatically. This allows a trusted backend to create a project and issue a short-lived, project-scoped key for different users or sessions.

Never expose a master API key to a browser, agent, end user, or other untrusted runtime. Keep it in your trusted backend and give downstream environments only the narrowly scoped key they need. See "Integrating Rowan Into a User-Facing Platform" for example architectures and Python code.

Security and lifecycle

Treat every API key as a secret:

  • Store keys in a secrets manager, not in plaintext in your application database unless necessary. If a database must hold a key, encrypt it at rest and tightly restrict access.
  • Never log keys. Scrub them from request logs, error reports, traces, and debugging output.
  • Revoke a key when its user, session, or integration is terminated.
  • Rotate long-lived keys regularly by creating a replacement, updating its consumers, and then revoking the old key.
  • Use the expiration date as a backstop, not a substitute for revocation.

Revoke an API key

Navigate to "Account" → "API Keys." Hover over the key you want to revoke, click the trash icon, and confirm the action.

Revocation takes effect immediately. When rotating a key, update its consumers to use the replacement before revoking the old key.

Revoking a key prevents future use of that credential, but it does not delete projects, workflows, or results.