API Keys
Debbie's API key management system lets you issue scoped, expiring keys with granular permissions for every integration scenario.
Key Management Built In
Debbie provides a complete API key management system. Developers can generate keys with specific permissions, set expiration dates, restrict by IP address, and rotate keys — all from their dashboard. Administrators can view all keys, revoke compromised keys, and set organization-wide policies.
Key Types
Server Key
Full access for backend services and server-to-server communication. Can read and write data.
Read-only Key
Ideal for monitoring, analytics, and reporting tools that only need to fetch data.
Sandbox Key
Test against a sandbox environment without affecting production data.
Webhook Key
Dedicated key for webhook endpoints with restricted event subscription permissions.
Security Features
- Prefix + Hashed Storage — Keys are stored as one-way hashes. Only the prefix is visible after generation.
- Expiration — Set TTL on any key. Auto-expired keys are rejected automatically.
- IP Restrictions — Optionally restrict keys to specific IP addresses or CIDR ranges.
- Scoped Permissions — Each key can be limited to specific OAuth scopes.
💡 For Platform Administrators
Administrators can set default rate limits per key type, configure allowed IP ranges at the organization level, and revoke keys across all applications from the admin dashboard.