How a project scopes data
An organization holds projects, members and the subscription. A project holds monitors, Observe and Measure sources, public pages and the changelog. An MCP connection reaches one project, so an agent cannot read or change a sibling project.
Key types
- Observe key,
obs_ - Secret. Sends errors for one source and one environment. Keep it on the server.
- Heartbeat token,
hb_ - Secret. Part of one monitor's heartbeat URL. Anyone with it can report a run.
- Measure token,
msr_ - Public. Embedded in the page. The hostname allow list decides which pages can send data.
- MCP tokens,
mcoat_andmcort_ - Issued to an MCP client through OAuth. You never copy them. Read Connect an MCP client.
Create a key
Ask your connected agent. The response contains an obs_ key or hb_ token once, and later reads never return it. The dashboard shows only the first characters of an Observe key. A Measure token is public and can be read again.
Create an Observe source named api for the staging environment. Show me the key.
Rotate a key
-
Step 1. Ask your agent to rotate the source with a grace period. The default is 24 hours and the maximum is 7 days.
Prompt textRotate the Observe key for the api source with a one hour grace period. Show me the new key. -
Step 2. Deploy the new key before the grace period ends.
-
Step 3. After the grace period, the old key receives
401withinvalid_api_key.
A Measure token rotates with no grace period: the old token stops at once. Deploy the new snippet right after rotation. A heartbeat token is reissued instead, which needs approval.
Revoke a key
Revoking a source or reissuing a heartbeat token is destructive. The request waits under "Pending confirmations" on the project's "Connect an agent" screen until an owner or admin selects "Approve".
Troubleshoot
- A key was lost
- Rotate it and deploy the new key before the grace period ends.
- Events show the wrong environment
- The key sets the environment. Create a separate source for each environment.
- Requests with a key return 401
- The key is unknown, revoked, or past its grace period. Use the newest key.
Limits
- The dashboard does not create or display full keys.
- Keys have no permission scopes. An Observe key sends data for its own source only.