Platform
API keys
API keys authenticate the SDK to the Staso ingest API. Org-wide or scoped to specific workspaces.
Create
- Settings -> API Keys -> New Key in the dashboard.
- Name it. Set an optional expiry.
- Pick a scope (below).
- Copy the raw key immediately — it's shown once and stored as a hash.
The dashboard keeps a key_prefix (first 12 chars) so you can identify a key later without revealing the secret.
Scopes
| Scope | What it can do | Use when |
|---|---|---|
full_org | Ingest into any workspace in the org. | Single-team orgs. |
workspace_scoped | Ingest only into the workspaces you list. | Per-env or per-team keys. |
Pick workspace_scoped whenever a key ships to an environment that should not be able to write to other workspaces — for example, a prod deploy key that must never touch staging.
Use the key
st.init(api_key="ak_live_...", workspace_slug="prod")export STASO_API_KEY=ak_live_...
export STASO_WORKSPACE_SLUG=prodIf workspace_slug is not set, the backend falls back to the key's default workspace.
Rotate
- Create a new key with the same scope.
- Deploy it alongside the old one (env var swap).
- Watch the dashboard — new ingests show up under the new
key_prefix. - Deactivate the old key.
No downtime. Clean cutover point in the UI.