API keys

An API key lets a script, a CI pipeline or an AI tool work with your organisation without a person signing in. Each key belongs to one organisation, does only what its permissions allow, and can expire and carry a monthly spend limit.

Create a key#

Owners and admins can create keys.

1. Open API keys. Go to Settings → API keys and choose Create key.
2. Name it. Enter a Key name that says where it is used, such as “Deployment automation”.
3. Set limits. Optionally set a Monthly spend limit (USD, optional), and choose when it Expires: In 30 days, In 90 days (the default), In 1 year or Never (until revoked).
4. Choose permissions, then choose Issue key.
5. Copy it now. The full key is shown once. Store it in your CI’s or tool’s secret store. Plexivo keeps only a fingerprint.

Every key starts with plx_live_. Plexivo emails you when a key is created in your name, so a key you did not make never goes unnoticed.

Permissions#

A key can do only what its permissions allow. A key with none can do nothing. A key also never does more than the person who created it can do.

New keys start with read and write. Give a key only what its job needs: a deploy pipeline needs read and write, and rarely destructive or billing.

Whatever its permissions, an API key can never manage people or access. It cannot invite or remove members, change roles or policies, create or revoke keys, approve support access, export or delete the organisation, or create a new organisation. A person signs in to do those.

Limits on every key#

Each key has its own limits, so a runaway script stays small:

A request over a limit is answered with 429 and, for the per-minute limit, a Retry-After header. See Rate limits.

Monthly spend limit#

The spend limit counts what the key buys directly and the running charges of the resources it creates, for the calendar month. Plexivo checks it before the key creates a resource: if this month’s spend, plus the rest of the month for the key’s running resources and the new one, would pass the limit, the request is refused with spend_limit_exceeded. Leave it empty for no limit.

Use a key#

Send the key as a bearer token:

curl https://api.plexivo.io/api/v1/tenants \
  -H "Authorization: Bearer $PLEXIVO_TOKEN"

The Plexivo CLI reads a key from PLEXIVO_TOKEN, or stores one with plexivo auth login --api-key. AI tools connect over MCP with a key; see Settings → Developer access.

Rotate and revoke#

• Revoke a key in Settings → API keys with Revoke. Anything using it stops working at once.
• Rotate by creating a new key, switching your pipeline to it, then revoking the old one. The list shows when each key was Last used, so you can see when the old one goes quiet.
• End every key you made, in every organisation: after you change your password in Settings → Security, choose End all my API keys. Service-account keys are not affected.
• When someone leaves, removing them from the organisation revokes the keys they created there.

An expired key stops working at once.