Skip to main content
API keys authenticate requests to the Gecko v1 API and can also connect AI tools that don’t support OAuth. Keys are scoped to the team they’re created in. Manage them in Settings > API Keys.
API keys are available on Pro and Enterprise plans.

​
Create a key

1

Open API Keys

Go to Settings > API Keys and click Create API Key.
2

Name it

Give the key a descriptive name, such as CI/CD Pipeline or Production.
3

Copy the key now

Gecko shows the full key value once, at creation. Copy and store it securely; afterward only a masked preview is shown.
A key can do anything the owner’s role allows. For scope-limited access, such as an AI tool that should only read findings, connect an OAuth agent under Settings > Integrations instead. See Connect AI tools.

​
Use a key

Send the key either as a bearer token or in the X-API-Key header:
Gecko scopes every response to the team attached to the key and checks the key owner’s current role permissions on every request. See the API reference for endpoints, rate limits, and examples.

​
Manage and revoke

Keys are visible to the whole team. The API Keys table shows each key’s name, masked preview, who created it, creation date, and last-used time. Usage is logged per request, so last-used stays accurate. Delete a key to revoke it immediately. You can always delete your own keys; deleting a teammate’s requires the api_keys.manage permission.
Deleting a key takes effect right away, including for any AI tools connected with it. Rotate by creating the new key first, updating your integration, then deleting the old one.