Skip to main content

Projects and keys

Every monitor, source and key belongs to one project. Your agent creates each key. Secret keys are shown once and rotate with a grace period.

Samples run on , facts checked on

How a project scopes data

An organization holds projects, members and the subscription. A project holds monitors, Observe and Measure sources, public pages and the changelog. An MCP connection reaches one project, so an agent cannot read or change a sibling project.

Key types

Observe key, obs_
Secret. Sends errors for one source and one environment. Keep it on the server.
Heartbeat token, hb_
Secret. Part of one monitor's heartbeat URL. Anyone with it can report a run.
Measure token, msr_
Public. Embedded in the page. The hostname allow list decides which pages can send data.
MCP tokens, mcoat_ and mcort_
Issued to an MCP client through OAuth. You never copy them. Read Connect an MCP client.

Create a key

Ask your connected agent. The response contains an obs_ key or hb_ token once, and later reads never return it. The dashboard shows only the first characters of an Observe key. A Measure token is public and can be read again.

Prompt text
Create an Observe source named api for the staging environment. Show me the key.

Rotate a key

  1. Step 1. Ask your agent to rotate the source with a grace period. The default is 24 hours and the maximum is 7 days.

    Prompt text
    Rotate the Observe key for the api source with a one hour grace period. Show me the new key.
  2. Step 2. Deploy the new key before the grace period ends.

  3. Step 3. After the grace period, the old key receives 401 with invalid_api_key.

A Measure token rotates with no grace period: the old token stops at once. Deploy the new snippet right after rotation. A heartbeat token is reissued instead, which needs approval.

Revoke a key

Revoking a source or reissuing a heartbeat token is destructive. The request waits under "Pending confirmations" on the project's "Connect an agent" screen until an owner or admin selects "Approve".

Troubleshoot

A key was lost
Rotate it and deploy the new key before the grace period ends.
Events show the wrong environment
The key sets the environment. Create a separate source for each environment.
Requests with a key return 401
The key is unknown, revoked, or past its grace period. Use the newest key.

Limits

  • The dashboard does not create or display full keys.
  • Keys have no permission scopes. An Observe key sends data for its own source only.

Send your first signal today.

14 days free, no card required. Then $29 a month.

Start your 14-day free trial