API keys & permissions
Create a key
- Open the workspace → Settings → API Keys (requires Admin or Owner role).
- New API key: choose a name, optionally an expiry date, and select the desired permissions.
- The key (JWT) is shown only once — copy and store it securely right away.
A key can be revoked at any time; it is rejected immediately afterward.
Management via session only
Creating and revoking API keys requires a logged-in session (Admin/Owner role) and is not possible via API key. For instance administration there is also the separate instance master key.
Permissions
Each key carries granular scopes following the pattern <ENTITY>_<ACTION>. The permission required
per endpoint is listed in the API Reference. Full catalog:
| Area | Permissions |
|---|---|
| Cocktails | COCKTAILS_READ, COCKTAILS_CREATE, COCKTAILS_UPDATE, COCKTAILS_DELETE |
| Ingredients | INGREDIENTS_READ, INGREDIENTS_CREATE, INGREDIENTS_UPDATE, INGREDIENTS_DELETE |
| Garnishes | GARNISHES_READ, GARNISHES_CREATE, GARNISHES_UPDATE, GARNISHES_DELETE |
| Glasses | GLASSES_READ, GLASSES_CREATE, GLASSES_UPDATE, GLASSES_DELETE |
| Units | UNITS_READ, UNITS_UPDATE |
| Queue | QUEUE_READ, QUEUE_CREATE, QUEUE_UPDATE, QUEUE_DELETE |
| Statistics | STATISTICS_READ, STATISTICS_CREATE, STATISTICS_DELETE |
| Menus | CARDS_READ, CARDS_CREATE, CARDS_UPDATE, CARDS_DELETE |
| Calculations | CALCULATIONS_READ, CALCULATIONS_CREATE, CALCULATIONS_UPDATE, CALCULATIONS_DELETE |
| Workspace | WORKSPACE_READ, WORKSPACE_UPDATE |
| Members | USERS_READ, USERS_UPDATE, USERS_DELETE |
| Ice | ICE_READ, ICE_CREATE, ICE_UPDATE, ICE_DELETE |
| Ratings | RATINGS_READ, RATINGS_CREATE, RATINGS_DELETE |
| Monitor | MONITOR_READ, MONITOR_UPDATE |
Least privilege
Grant each key only the permissions the integration actually needs
(e.g. only COCKTAILS_READ + INGREDIENTS_READ for a read-only menu export).
Expiry & revocation
- Expiry (
expiresAt): optional. After expiry the key is rejected. - Revocation: takes effect immediately (with a short cache), regardless of expiry.