DocsGetting Started
Authentication & API Keys
Learn how API keys are formatted, authenticated, securely stored via SHA-256, and managed server-side.
4 min read•API v1
Bearer Token Authentication
PingStack uses Bearer authentication. You must pass your secret API key in the `Authorization` header of every HTTPS request.
Header Format
Authorization: Bearer ps_secret_live_YOUR_API_KEYHow Keys are Stored & Protected
* **SHA-256 Hashing**: PingStack stores only the cryptographically secure SHA-256 hash of your API key in the database (`api_secret_hash`).
* **One-Time Secret Display**: Plaintext secrets are revealed **once** during key generation and can never be read again from the database or logs.
* **Server-Side Tenant Scoping**: Every API key is strictly scoped to its owning workspace. Client-supplied tenant IDs are ignored.
* **Last Used Tracking**: PingStack updates `last_used_at` asynchronously without slowing down request execution.
Never expose your API keys in client-side code, browser JavaScript, mobile apps, or public Git repositories. All API calls must originate from your secure backend server.
Managing API Keys Programmatically
You can list, create, and revoke API keys via `/api/v1/keys`.
# List Keys
curl https://app.pingstack.in/api/v1/keys \
-H "Authorization: Bearer ps_secret_live_YOUR_API_KEY"
# Create Key
curl -X POST https://app.pingstack.in/api/v1/keys \
-H "Authorization: Bearer ps_secret_live_YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "Billing Service Key", "description": "Used by invoices worker"}'
# Revoke Key
curl -X DELETE "https://app.pingstack.in/api/v1/keys?id=KEY_UUID" \
-H "Authorization: Bearer ps_secret_live_YOUR_API_KEY"