API keys

An API key is the read credential for your organization’s data outside the dashboard. The query API and the MCP server both accept it. Keys belong to an organization, not to a person: any member can create one, and each key reads all of the organization’s telemetry.

API keys and ingest keys

Scout Trails uses two kinds of key, and they are not interchangeable.

	API key	Ingest key
Purpose	Read data through the API or the MCP server	Send telemetry from a coding agent
Belongs to	The organization	One actor
Looks like	`wb_api_` followed by 43 letters, digits, `-` and `_`	A 43-character token with no prefix
Managed on	Manage > API keys	Manage > Actors & ingest keys
Shown again later	Yes, on the key’s row, to its creator and admins	Yes, on the actor’s row, to every member

An ingest key sent to the API or the MCP server is rejected as unauthenticated, and an API key sent to the ingest endpoint is rejected too. To set up an agent, see Agents.

Opening the API keys page

Sign in to the dashboard at https://scoutmonitoring.io.
Open the organization menu (the organization name in the top bar) and select Manage.
Select the API keys tab.

Every member of the organization can open this page and see every key in the list. A key’s value, with its Copy button, appears only to the member who created it and to admins.

Creating a key

Any member can create a key; no admin role is needed.

On the API keys page, find the New API key card.
In What is it for?, enter a name that says where the key will be used, for example Grafana dashboard or Weekly cost report. The name is required and can be up to 120 characters.
Select Create key.

The page shows a confirmation banner, “API key name created.”, and a dialog titled API key issued for name that contains the full key.

Select Copy in the dialog, then Done. Store the key in a secrets manager or an environment variable.

The key also stays on its row in All keys, where you and the organization’s admins can copy it again later.

If the name is only spaces, the page shows “Name the key so it can be recognised later.” and no key is created.

The key list

The All keys card lists every key in the organization, newest first. Its header shows how many keys are live out of the total, for example 2 live of 3.

Column	Shows
Name	The name entered when the key was created.
Key	The full key with a Copy button, on keys you created and, for an admin, on every live key. A revoked key shows —. Another member’s key shows — to a member; hover over it to see “Visible to its creator and org admins.” A live key you can manage that shows — has no stored value to display; it still works, and rotating it gives it one you can view.
Created by	The email of the member who created the key, with a you badge on your own keys. If that member is no longer in the organization, it reads “creator has left the organization”.
Created	The creation date.
Status	live, or revoked with the revocation date.

Revoked keys stay in the list so you keep a record of them. Revoking a key also deletes its stored value, so a revoked key cannot be viewed or copied.

When the organization has no keys, the card reads “No API keys yet.” and offers Create the first key, which jumps to the New API key form, and Ingest keys are over here, which opens the Actors & ingest keys tab.

Rotating a key

Rotating a key replaces its value and keeps everything else: its name, creator and creation date stay the same. The previous value stops working immediately, in both the API and the MCP server, and the new value works at once.

On the API keys page, find the key in All keys.
Select Rotate key on its row. A dialog titled Rotate name? asks you to confirm and reminds you that the current value stops working immediately.
Select Rotate to go ahead, or Cancel to close the dialog and leave the key unchanged.

The page shows “API key name rotated. The previous key stopped working immediately.” and opens the same dialog as after creating a key, with the new value and a Copy button. The new value also replaces the old one on the key’s row. Update every client that used the old value.

Who can rotate a key is the same as who can revoke it; see the table below. A revoked key cannot be rotated: the page shows “That key is revoked. Create a new key instead.”

Revoking a key

Revoking a key stops it working immediately, in both the API and the MCP server. Revocation cannot be undone; create a new key if you need access again.

On the API keys page, find the key in All keys.
Select Revoke on its row. A dialog titled Revoke name? asks you to confirm and reminds you that the key stops working immediately and cannot be restored.
Select Revoke to go ahead, or Cancel to close the dialog and leave the key unchanged.

The page shows “API key revoked.” and the key’s status changes to revoked. Clients still using the key receive 401 from the API and an unknown bearer key error from the MCP server.

Who can view, copy, rotate or revoke a key:

Key	Admin	Member
A key you created	Yes	Yes
A key another member created	Yes	No
A key whose creator has left the organization	Yes	No

Rotate key and Revoke appear on the live keys you can manage. If a request to rotate or revoke a key you cannot manage reaches the server, the page shows “Only an admin can rotate a key someone else created.” or “Only an admin can revoke a key someone else created.” and the key is unchanged.

Removing a member from the organization revokes every key they created in it. Those are the only keys a member can view, so removal revokes every key they could view as a member. An admin can view every key; after removing an admin or demoting one to member, rotate the organization’s other live keys. See Removing a member.

Messages you can see

Message	Meaning
API key name created.	The key was created. Copy it from the dialog or from its row.
API key name rotated. The previous key stopped working immediately.	The key has a new value. Copy it from the dialog or from its row.
Name the key so it can be recognised later.	The name was blank.
You are not permitted to create keys in this organization.	Your account is no longer a member of this organization.
API key revoked.	The key no longer works.
Only an admin can revoke a key someone else created.	You tried to revoke a key you did not create, and you are not an admin.
Only an admin can rotate a key someone else created.	You tried to rotate a key you did not create, and you are not an admin.
That key is revoked. Create a new key instead.	You tried to rotate a revoked key.
That key no longer exists.	The key was removed before your request reached it.
That key is not in this organization.	The key belongs to a different organization from the one you are working in, for example after you switched organizations in another tab. The page returns `404`.
Could not create the API key. / Could not rotate that key. / Could not revoke that key. / Could not load API keys. / Could not load this organization’s API keys.	A server error. Try again.

Good practice

Create one key per integration, named for where it runs, so you can revoke one without breaking the others.
Keep keys out of source control. Read them from an environment variable or a secrets manager.
Revoke a key as soon as the integration that used it is retired. If a key may have been exposed, rotate it, or revoke it if nothing should use it any more.