Keys and access

Every request to AbuseZero carries one credential, and every credential reaches only the workspaces it was granted. Choose the credential by where the code runs and what it needs to do.

WorkspacesCopy Anchor Link

Everything in AbuseZero belongs to a workspace: benefits, policies, evaluations, outcomes, allow and block lists, keys and billing. Workspace IDs start with ws_. See the workspace object.

Each workspace's data stays in that workspace. A credential can never be used to read or change another workspace, and no request parameter widens what a credential can reach.

Members, roles and permissions are managed in the dashboard under Workspace settings → Members & access.

Credential typesCopy Anchor Link

Keys are sent in the Authorization header:

Authorization: Bearer sk_…

The full list of scopes and which endpoints need them is in REST API authentication.

Secret and restricted keysCopy Anchor Link

Server keys are created in Developers → API keys.

• Secret keys have full access to the workspace. Use them where one service runs your whole integration.
• Restricted keys have only the scopes you choose. Use them to give each service exactly what it needs, such as evaluations:create and outcomes:write for the service that grants trials.
• A key's type and expiry are set when you create it and never change. Choose an expiry from 1 to 3,650 days, or none.
• When a key is revoked or expires, requests with it fail with INVALID_API_KEY or API_KEY_EXPIRED (see REST API errors). Create a new key and replace it in your environment.

Key emailsCopy Anchor Link

AbuseZero emails the workspace's owners and admins about every server key, so a key never stops working without warning.

Each email names the key, shows its prefix and last four characters, and gives the exact time in UTC. The key's creator gets these emails while they're still a member of the workspace. The publishable key doesn't expire and can't be revoked, so it gets none of them.

Publishable keyCopy Anchor Link

Your publishable key is for the AbuseZero browser SDK and the standalone browser script. It can only send browser data for your claims, so it is safe in your page source.

• Browser data is accepted only from HTTPS sites in your site list, under Your sites in Developers → Browser setup, or through PATCH /v1/browser-collection.
• The publishable key can't call server endpoints. A server request with it fails with KEY_TYPE_NOT_ALLOWED (see Troubleshooting).

OAuthCopy Anchor Link

The AbuseZero CLI, the AbuseZero MCP server and other OAuth apps sign in with OAuth instead of a key. The user signs in to AbuseZero in the browser and approves the scopes the app asks for.

• An OAuth token acts as the user who approved it, with that user's role and permissions in each workspace.

• Requests made with an OAuth token choose the workspace with the AbuseZero-Workspace header (see How requests choose a workspace):

  Copy Text

  Authorization: Bearer <access token>
  AbuseZero-Workspace: ws_1c9e7b42-5d3a-4f81-a6e2-0b7d94c3f518

• GET /v1/workspaces lists the workspaces a token can use. A token granted for one workspace lists only that workspace.

• Apps you've authorized appear in Developers → Connected apps. Disconnecting an app revokes its access.

Machine clientsCopy Anchor Link

Machine clients let the AbuseZero CLI run in scripts and CI without a person signing in (see Use the CLI in scripts and CI). Create one in Developers → Connected apps. It works only in the workspace it was created in.

export ABUSEZERO_CLIENT_ID="…"
export ABUSEZERO_CLIENT_SECRET="…"
abusezero benefits list

Choosing a credentialCopy Anchor Link

Next stepsCopy Anchor Link