Create and manage API keys

API keys let you authenticate with the Shipstar API from scripts, CI pipelines, or any external tool. You create and manage them from the API Tokens page in the dashboard. Each key is only shown to you once at creation time, so it is important to copy it immediately and store it somewhere safe.

Create a new API key

1. Log in to app.shipstar.ai and click API Tokens in the sidebar.
2. Click Create API Key.
3. Give the key a descriptive name — for example, Production Server, CI/CD Pipeline, or Local Development. A clear name makes it easy to identify which key is which if you need to revoke one later.
4. Optionally, set an expiration date. If you leave this blank, the key does not expire automatically.
5. Click Create and copy the key that appears. This is the only time the full key is shown — Shipstar stores only a hashed version and the first 8 characters for identification purposes, so the raw key cannot be retrieved after you close this screen.

Use your API key

Include your key as a Bearer token in the Authorization header of every API request:

Authorization: Bearer YOUR_API_KEY

Store it in an environment variable rather than hardcoding it, and never commit it to version control or include it in client-side code.

Manage existing keys

• Deactivate: If you suspect a key has been compromised or no longer need it temporarily, you can deactivate it without deleting it. A deactivated key stops working immediately.
• Delete: Permanently removes the key. Any integration using it will stop authenticating.
• Last used: Each key tracks a last_used_at timestamp, which helps you identify keys that are no longer in active use.

Tips

• Create a separate key for each environment or integration so you can revoke one without disrupting the others.
• If you lose a key, deactivate or delete it and create a new one — there is no way to recover the original value.
• API keys authenticate against the Shipstar API (/api/v1/). The dashboard itself uses a separate session-based login and does not use API keys.