Requesting an API Key
Baseline API keys are self-serve. Any admin can create, edit, and revoke keys directly in the Baseline portal — you no longer need to contact the Customer Success team to request one.
Creating an API Key
- Sign in to Baseline as an admin.
- Go to Company Settings > General Settings > API Tokens.
- Click Add Token.
- Give the key a descriptive name, such as the integration it will power.
- Optionally set an expiry date. Leave it blank to create a key that never expires.
- Click Create. The key is shown once. Copy it immediately and store it in a secrets manager.
Your key will start with bl_pat_. This is the value you pass in API requests — see Authentication for the header format and examples.
After the key is created, the API Tokens table shows only the last four characters, along with the key's name, expiry, last used date, and the admin who created it. The full key is never recoverable. If it is lost or compromised, delete it and create a new one.
Permissions
API keys can only be created by admins, and a key has the same full admin access as the person who created it. There is no per-key permission scoping.
Because a key is tied to its creator:
- Deactivating or offboarding that admin immediately revokes every key they created.
- If that admin's access level is later changed to Member or Individual, their keys drop to the reduced access of that level.
Revoking or Updating an API Key
From the API Tokens table, open the actions menu on any key:
- Edit — rename the key or change its expiry date.
- Delete — revoke the key. Revocation takes effect immediately.
Expired keys cannot be edited. Create a new key instead.
Best Practices
- Create a separate key for each integration so you can revoke one without affecting the others.
- Give each key a name that identifies the system using it.
- Store keys in a secrets manager. Never commit them to source control or share them over email or chat.
- Set an expiry date on keys used for time-bound work.
Legacy API Keys
API keys issued by the Customer Success team before self-serve keys were introduced continue to work. These are UUID-style keys without the bl_pat_ prefix. No action is required, but we recommend replacing them with self-serve keys so you can manage and rotate them yourself.