Manage keys

Sazabi has two kinds of keys. Use the right one for the job:

• Public keys — project-scoped, for sending data in (log ingestion via OTLP, webhooks, and the browser SDK). They can only write telemetry, so they are safe to ship in clients. Prefixed sazabi_public_.
• Secret keys — organization-scoped by default (a key can also be scoped to a single project), for reading and writing the API (the API, the CLI, and the MCP server). They grant full read/write access, so keep them server-side. Prefixed sazabi_secret_.

Sazabi has no "API keys" — a credential is either a public key or a secret key.

For sending data in, you normally use your intake URL (from Settings > Log streams), which has your public key embedded in it — you rarely handle the raw public key. This page is for managing the underlying keys when you need to: viewing them, rotating, or deactivating.

Choosing the right key

Create a public key

Public keys are provisioned when you set up a log source, not created standalone.

1. Go to Settings > Public keys (project-scoped) to view and manage the keys your project already has.
2. To provision a new one, connect a log source (see Instrument); the setup flow creates the key for that source.
3. Copy a key's value where the flow shows it — it is displayed only once. Store it in your secret manager or platform environment.

There is no sazabi public-keys create command — bare public-key creation is intentionally not exposed; keys are provisioned through log-source setup. From the CLI you can list existing keys and manage their lifecycle (verify against /reference/cli):

sazabi public-keys list                       # List public keys in the active project
sazabi public-keys deactivate <key-id>        # Revoke a public key

Create a secret key

sazabi secret-keys create "ci-automation"     # Create a secret key; its value is printed once
sazabi secret-keys list                        # List secret keys in the organization
sazabi secret-keys delete <key-id>             # Revoke a secret key

Rotate and revoke

Both key types can be rotated and revoked. To rotate a secret key, create a new one, move your clients to it, then revoke the old one. To rotate a public key, set up a replacement log source connection and retire the old one. Revocation is immediate: any client still using a revoked key loses access at once. Keep keys out of source control.

Verify

1. Connect a log source to provision a public key, then send a test log with it (see Instrument); the log should appear in the project.
2. Create a secret key, then run sazabi auth whoami after authenticating with it — it should report your organization and project.

If a request is rejected as unauthorized, confirm you are using the right key type for the surface and that the key has not been revoked.

Further reading