FileNest/Docs

API Keys

The API Keys page (/projects/{projectId}/api-keys) manages project-scoped API keys. Every key is bound to a single project and carries an explicit set of scopes.

Key types

PrefixEnvironmentUse case
fn_live_...ProductionLive traffic
fn_test_...Test / stagingDevelopment and CI

Creating a key

  1. Click Create key
  2. Enter a display name (e.g. backend-prod, ci-runner)
  3. Select the key type (live or test)
  4. Select the scopes the key needs

Save your key

The full API key is shown exactly once on creation. Copy it immediately to a secret manager or environment variable — it cannot be retrieved again.

Available scopes

Scopes are grouped by resource in the creation form. Only check the scopes the key actually needs.

Files

ScopeGrants access to
files:uploadUpload files (single and multipart)
files:downloadGenerate presigned download URLs
files:readList and inspect files and version history
files:deleteDelete files
files:metadataUpdate file tags, metadata, and filename

Folders

ScopeGrants access to
folders:readList folders, resolve paths, list files in folder
folders:writeCreate folders, ensure paths, move files, delete folders

Upload Tokens

ScopeGrants access to
upload_tokens:createIssue short-lived browser upload tokens

Webhooks

ScopeGrants access to
webhooks:readList webhook endpoints and delivery history
webhooks:writeCreate, update, and delete webhook endpoints

Projects

ScopeGrants access to
projects:readRead project configuration, usage, and dashboard
projects:updateUpdate project settings and storage configuration

Audit & Compliance

ScopeGrants access to
audit:readRead audit log entries
compliance:manageConfigure WORM, legal hold, and retention policies

Revoking a key

Click Revoke in the row actions menu. Revocation is immediate — the key stops working within seconds. Revoked keys are shown with a revoked badge and cannot be re-activated; create a new key if needed.

Best practices

  • Follow the principle of least privilege — only grant the scopes the consumer actually needs
  • Use fn_test_... keys in development and CI to avoid hitting production data
  • Rotate keys regularly — revoke the old key and create a new one
  • Never commit API keys to source control; use environment variables or a secret manager