API keys.
Simple keys, serious controls.
For tooling, scripts, and partner integrations that don't want an OIDC handshake. Org-level keys for shared automation, user-level keys for personal scripts. Scopes, IP allowlists, expiry, lastUsedAt, and one-click rotation come standard.
Pick by ownership
Org-level keys
Shared credentials your team manages. Survive any single member leaving. Good for backend automation, CI/CD, partner integrations.
User-level keys
Personal credentials tied to one human. Move with the user; revoke automatically if the user leaves the Org. Good for ad-hoc scripts and personal CLI tooling.
Shaped for safe ops
Prefix
A short, visible identifier (e.g. `synq_live_…`) that lets you spot a key at a glance in code, logs, and dashboards — without revealing the secret half.
Encrypted secret
The full key is encrypted at rest with AES-256-GCM. Shown once at creation; never displayed again. Rotation issues a new secret without exposing the old.
Scopes
A bounded set the key can act under. Same scope catalog as your OIDC apps — including brand-scoped custom scopes you defined.
Expiry
Optional. Set a TTL up front and Synq invalidates the key when it elapses. Useful for short-lived ops keys or contractor access.
IP allowlist
CIDR ranges the key is allowed to call from. Useful for hardened production keys; Synq rejects calls from any IP outside the allowlist.
lastUsedAt
Updated on every use. Lets you find stale keys and revoke them safely.
When to reach for what
M2M / client_credentials
Standards-based OIDC tokens for backend-to-backend calls. Pick this when you want short-lived JWTs and audit-log unification.
Device flow
For CLIs that need a user’s consent, not a shared secret. Pick this over a personal API key when the action is on behalf of the user.
Audit log
Every API key creation, rotation, and revocation lands in the audit log.
Common questions
One key for tooling, one click to rotate.
Scopes, IP allowlist, expiry, audit-log integration — every API-key control you would otherwise build yourself.