API Keys
Create scoped API keys for programmatic access to SmoothDeploy and for Email Validation test steps
API keys let external systems and test steps authenticate with SmoothDeploy without a user session. Each key carries a set of scopes that limit what it can do.
Permissions
All roles can view the key list. Admins and owners can create, edit, and delete keys. See Roles and permissions.
Create a Key
- Go to Operations → API Keys in the sidebar and click Create API Key.
- Enter a Name. It must start with a letter and may contain letters, numbers, hyphens, and underscores (max 64 characters). You cannot use reserved environment variable names.
- Under Scopes, tick at least one action. See the scope table below.
- Optionally, enter one IPv4/IPv6 address or CIDR range per line in Allowed IPs (optional). Leave it empty to allow requests from any IP.
- Click Create.
A dialog shows the new key value. Copy the key now. Once you close this dialog the full value is not shown again. Use the reveal button to view it or the copy button to copy it. If you lose the value, delete the key and create a new one.
Available Scopes
The scope picker groups actions by resource. Tick the checkboxes for the access the key needs.
| Group | Actions |
|---|---|
| Email inboxes | read, delete |
| Tests | read, create, update, delete, run, cancel |
| Test runs | read |
| Schedules | read, run, pause, resume |
See Scopes for what each action permits.
IP Allow-List
You can restrict a key to specific IP addresses at creation time or later by clicking the globe icon on the key's row. Enter one IPv4/IPv6 address or CIDR range per line (for example 203.0.113.5, 10.0.0.0/8, 2001:db8::/32). An empty list allows all IPs.
Revoke a Key
Click the trash icon on any row and confirm.
Revoking a key is permanent
Any test step, schedule, or integration using the revoked key will fail until you update it with a new one.
Use a Key in an Email Validation Step
To check emails in a test, you need a key with Email inboxes: read. In the test step editor, select it by name from the API Key dropdown in the Email Validation step. The runner injects the value at run time; you do not need to store it as a secret.
See Email Inboxes for the full end-to-end flow.