API Keys
API keys are managed from Dashboard sidebar Settings / Developer & API and are used for CLI auth and other scoped automation flows.
CREATING A KEY
The settings page includes fields for name, scopes, and optional expiration.
Only shown once
New key values are only shown at creation time. After that, rotate or revoke from the key list.
Credential prefixes are intentional
Dashboard API keys begin with bd_. SDK upload credentials begin with sdk_ and are managed separately under the SDK credential endpoints. Browser extension devices use ext_ plus an approved project grant.
AVAILABLE SCOPES
- project:read
- Read project metadata and settings
- project:create
- Create projects and POST project-scoped resources such as builds
- project:write
- Write project-level changes
- project:delete
- Delete project-scoped resources
- project:*
- All actions on project-scoped routes
- annotation:read
- Read annotation records
- annotation:create
- Create direct annotation resources
- annotation:write
- Write annotation changes
- annotation:delete
- Delete direct annotation resources
- webhooks:read
- List workspace or project outbound webhooks and delivery logs
- webhooks:write
- Create, update, or delete outbound webhooks
- api-key:*
- Manage developer API keys when the actor is allowed
- sdk:create
- Upload SDK source maps and deployments
Scopes use <resource>:<action>. The API normalizes plural URL resources, so webhooks:write applies to /webhooks/outbound. Use an exact scope, a resource wildcard such as project:*, or * when broader access is intentional.
Scope checks use the first URL resource, not the deepest feature name. For example, POST /projects/:projectId/build requires a project:create or project:* key.
KEY LIST
| Name | Prefix | Expires | Last Used | Actions |
|---|---|---|---|---|
Local Dev CLI | bd_dev... | Never | Just now | |
CI runner | bd_ci... | Mar 20, 2026 | 2h ago |
CLI EXAMPLE