API keys

API keys let something other than a browser reach your workspace — the GitHub workflow that publishes your docs, or your own scripts.

Create them in Settings → API keys.

Handling them#

Copy it when it's shown. Keys are stored hashed, so we can't show it to you again. Lose it and you create a new one.

Environment variables, not source control. A key in a repository is a key on every laptop that ever cloned it.

One key per use. A key for each repository and a key for each script means revoking one doesn't break the others, and you can tell from the name what broke when you do.

Revoke rather than reuse. Someone leaves, a laptop goes missing, a key ends up in a log — revoke it. Creating another takes seconds.

Docs tokens#

Create token on a knowledge base's GitHub tab makes a key scoped to reading and writing articles and FAQs and nothing else. Save it as your repository's ASKVORO_TOKEN secret — see Publish your docs from GitHub.

Docs tokens are listed here with your other keys, and you revoke them the same way.

API keys and signing secrets are different things#

Easy to confuse, so:

An API key authenticates you calling us. It goes in a request to AskVoro.

A signing secret proves we are calling you. It verifies a webhook we send to your backend. See the webhook contract.

Different directions, different secrets. Neither substitutes for the other.