Skip to main content
Every call to the Devic public API carries an API key. Keys are created and revoked from API keys in the console. API keys

​
Three restrictions worth using

A key with no restrictions can do everything the account can. That is the right shape for a key on your own server and the wrong shape for anything else.

​
Endpoints

Grant a key only the groups of endpoints it needs — assistants, agents, documents, memory, per-tenant integrations, and so on. API key scopes There is a ready-made devic-ui selection covering exactly what an embedded widget calls. It deliberately leaves out the privileged surfaces: tenant administration, and the ability to issue tenant sessions.

​
Domains

A key can be restricted to the domains it may be used from. Beyond limiting where it works, declaring the domains tells Devic the key is meant for a browser — which is what makes it refuse to mint tenant sessions.

​
Tenant identity mode

The one that matters most for a multi-customer product:
Keys created before this setting existed behave as open. Tightening them silently would have taken working integrations down, so the change is yours to make.

​
Which key for which job

Server key

Unrestricted, or scoped to what your backend calls. Never shipped to a browser. This is the key that mints tenant sessions.

Browser key

Endpoint-restricted, domain-restricted, signed. It can start a session and nothing else.
A key that has ever been in a bundle is public, whatever you do afterwards. Removing it from the code does not invalidate it — rotate it in the console.

​
Watching how they are used

API usage logs The usage log records calls per key: the endpoint, the response code and when. It answers both the operational question (“what is failing”) and the security one (“what is this key actually doing”).
Calls made with a tenant session are attributed to the key that issued it, so moving an integration to sessions does not empty the key’s metrics.

Tenant sessions

The credential to use in a browser.

API reference

Everything a key can reach.