API authentication

Create credentialsCopy Anchor Link

1. Sign in as an organisation administrator.
2. Open your profile menu, then Settings → Organization.
3. In API credentials, create a credential with a useful name, such as Production monitoring.
4. Copy the client key and the secret shown in the dialog.
5. Store the secret before closing the dialog.

The secret is displayed once. It is stored as a hash and cannot be recovered later. If it is lost, rotate the credential or create a replacement.

Credential formatCopy Anchor Link

New credentials use:

• Client key: pmc_ followed by 32 hexadecimal characters.
• Client secret: pms_ followed by 32 hexadecimal characters.

Earlier credentials with longer secrets remain accepted until rotated or revoked. Do not shorten an existing secret yourself.

Send both fields using the exact parameter names client_key and client_secret. A client key is not a service ID, and the endpoint does not use a Bearer token in place of these form fields.

Credentials are scoped to their organisation. A service or incident outside that organisation is not accessible through them.

Rotate safelyCopy Anchor Link

Rotate credentials immediately replaces both the client key and secret. Any integration using the old pair stops authenticating.

For a replacement without interrupting an integration:

1. Create a second named credential.
2. Store it and update the integration to use it.
3. Send a controlled test incident and confirm success.
4. Revoke the previous credential after confirming all callers have switched.

There can be at most 20 non-revoked credentials per organisation. Revoke unused credentials before adding more.

Revoke accessCopy Anchor Link

Revoke a credential when an integration is retired or the secret is exposed. Revocation blocks new authenticated requests. It does not remove incidents or their timeline history.

Keep credentials separate from examplesCopy Anchor Link

Use environment variables or your monitoring platform’s secret storage. Do not put secrets in URLs, browser links, screenshots, tickets, or committed scripts. The API rejects query parameters; credentials belong in the HTTPS form body.