API keys

Keys for CI, scripts and AI agents: what each kind may do, and how to create and revoke them.

Create a key#

Owners and admins: Settings → API keys → Create key. Give it a name for where it will be used (so you know which to revoke later) and choose what it may do:

• Run tests and read results: right for CI pipelines and scripts. It can also upload app builds and create share links.
• Also create and edit tests: for AI agents that write tests for you, and scripts that manage tests.

The key (qa_…) is shown once. Store it as a secret named QA_AI_API_KEY.

Revoke a key#

Revoke stops it straight away; anything using it stops working. The list shows each key's name, who made it, what it may do, when it was last used, and See its runs. Creating, revoking and using keys appears in the workspace's activity.

Good practice#

• One key per place it is used, so you can revoke one without the others.
• Keep keys in your CI's secret store, never in code.
• Give CI a key that can only run tests and read results.