Skip to main content
videas.comCreate ticketGo to app

Creating an API key

Generate, scope and manage the API keys that authenticate your calls to the Videas API.

Updated 28 Aug 2026apiauthenticationapi-keys

API keys authenticate server-to-server calls to the Videas API. A key belongs to an organization, not to a personal login, so it keeps working no matter who created it or whether they later leave the team. This guide walks through creating a key, choosing its scopes and expiry, and keeping it safe.

Before you start

  • You need the Manage API keys permission on the organization. Owners and admins have it by default; otherwise ask an admin to grant it on a custom role.
  • Decide which scopes the key needs — grant only the minimum. See Using the API for what each scope allows.

Create a key

  1. Open Settings → API keys in your Videas organization.
  2. Select Create key.
  3. Fill in the form:
    • Name — how you’ll recognise the key in the list (e.g. Production backend).
    • Description (optional) — a note about where the key is used.
    • Scopes — the permissions the key grants. Pick the minimum you need. The available scopes are Read Assets, Write Assets and Delete Assets.
    • Expiration — from 1 day up to 10 years. Defaults to 1 year. Choose Never only if a permanent key is unavoidable (not recommended for production).
  4. Confirm. The full key is shown once.

Warning: The raw key — it starts with sk_ — is displayed only at creation and can never be retrieved again. Copy it immediately and store it in a secrets manager. If you lose it, revoke it and create a new one.

Use the key

Send it as a Bearer token on every request:

curl https://api.videas.com/api/external/v1/videos/ \
  -H "Authorization: Bearer sk_your_key_here"

See Using the API for the full request format, scopes and rate limits.

Manage existing keys

The API keys table lists every key in the organization with:

  • its hint — the first 12 characters (e.g. sk_1a2b3c4d…) — so you can tell keys apart without exposing the secret;
  • its status (active or revoked), last-used date and expiry.

Open a key’s menu to view its details or revoke it. Revoking takes effect immediately and is permanent: calls using that key start returning 401 Unauthorized. The row is kept for audit.

Test key (playground)

To try the API without wiring a key into your code, use Try it out in the API reference. It mints a short-lived test key (about 60 minutes, with every read/write scope) tied to your organization. This requires the Use the test API permission. Each new test key replaces your previous one.

Note: Test keys expire on their own and are meant for the in-browser sandbox — never ship one inside an application.

Good practices

  • One key per app and environment — separate production, staging and CI so you can revoke one without breaking the others.
  • Least privilege — grant only the scopes each key actually uses.
  • Rotate — recreate keys periodically, and immediately after any suspected leak.
  • Never commit keys — keep them in environment variables or a secrets manager, never in source control or client-side code.