Docs
Powered by

API Keys

Generate and manage API keys for programmatic access to work.studio.

What Are API Keys?

API keys allow external applications to interact with work.studio programmatically:

  • Trigger automations
  • Query data
  • Manage resources
  • Integrate with CI/CD

Creating API Keys

Generate a New Key

  1. Go to Settings → API Keys
  2. Click + New API Key
  3. Configure the key:
    • Name: Descriptive identifier
    • Expiration: Optional expiry date
    • Permissions: What the key can do
  4. Click Create

Copy Your Key

API Key: {{ api_key_prefix }}a1b2c3d4e5f6g7h8i9j0...

Copy this key now. You won't see it again.

API Key Permissions

Permission Scopes

Scope Allows
automations:read View automations
automations:run Trigger automations
automations:write Create/edit automations
data:read Query data
data:write Write records
resources:read View resources
resources:write Manage resources
admin:* Full administrative access

Least Privilege

Only grant necessary permissions:

# For a CI/CD pipeline that triggers tests:
Name: "CI/CD Runner"
Scopes:
  - automations:run

# For a data sync service:
Name: "Data Sync"
Scopes:
  - data:read
  - data:write

Using API Keys

Authentication

Include the API key in the Authorization header:

curl -X POST api.work.studio/v1/automations/run \
  -H "Authorization: Bearer sv_live_a1b2c3d4..." \
  -H "Content-Type: application/json" \
  -d '{"automation_id": "abc123", "input": {"key": "value"}}'

Example: Trigger an Automation

const response = await fetch('api.work.studio/v1/automations/run', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sv_live_a1b2c3d4...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    automation_id: 'abc123',
    input: {
      customer_id: '12345',
      action: 'process'
    }
  })
});

const result = await response.json();
console.log(result.run_id);

Example: Query Data

const response = await fetch('api.work.studio/v1/data/query', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer sv_live_a1b2c3d4...',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    query: "SELECT * FROM records WHERE schema = 'orders' LIMIT 10"
  })
});

const data = await response.json();
console.log(data.rows);

Managing API Keys

View All Keys

  1. Go to Settings → API Keys
  2. See all active keys
  3. View usage statistics
Column Description
Name Key identifier
Created Creation date
Last Used Most recent API call
Expires Expiration date (if set)
Calls Total API calls

Rotate a Key

Replace an existing key with a new one:

  1. Click the key to open details
  2. Click Rotate Key
  3. Set transition period (optional)
  4. New key is generated
  5. Update your applications
  6. Old key stops working after transition

Revoke a Key

Immediately disable a key:

  1. Click the key
  2. Click Revoke
  3. Confirm action

Key Types

Live Keys

For production use:

  • Prefix: sv_live_
  • Access production data
  • Quota limits apply
  • Audit logged

Test Keys

For development:

  • Prefix: sv_test_
  • Access sandbox data
  • Higher rate limits
  • Useful for testing

Rate Limits

API calls are rate limited:

Plan Requests/Minute Requests/Day
Free 60 1,000
Pro 300 10,000
Enterprise 1,000 Unlimited

Rate Limit Headers

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1640000000

Handling Limits

if (response.status === 429) {
  const retryAfter = response.headers.get('Retry-After');
  await sleep(retryAfter * 1000);
  // Retry request
}

Security Best Practices

Secure Storage

# Environment variable (recommended)
export WORKSTUDIO_API_KEY="sv_live_a1b2c3d4..."

# .env file (gitignored)
WORKSTUDIO_API_KEY=sv_live_a1b2c3d4...

# Secret manager (production)
aws secretsmanager get-secret-value --secret-id workstudio/api-key

Audit Logs

Track API key usage:

  1. Go to Settings → API Keys → Logs
  2. Filter by:
    • Key name
    • Endpoint
    • Status (success/error)
    • Date range