Skip to main content
PlugKit has two ways in, both resolving to your account:
  • Dashboard session — you sign in at plugkit.co/dashboard with Google, GitHub, or email + password. The dashboard uses that session; you never handle a token yourself.
  • API key — for your own code. A Bearer key sent on every request. Create and manage keys from the dashboard’s API Keys section.
Everything is scoped per account: a key only ever sees the profiles, accounts, posts and conversations that belong to the user who created it.

​
Getting your first key

There’s no chicken-and-egg: sign in to the dashboard, open API Keys → New Key, name it (e.g. “Production server”), and copy the value. Then send it on every request:

​
Key format

Keys are sk_ followed by 64 hex characters. They are hashed server-side — PlugKit only ever shows the full key once, at creation. Store it in a secret manager, never in client-side code or a git repo.

​
Managing keys

Create a key

Dashboard API Keys → New Key, or POST /v1/api-keys — returns the plaintext key one time.

List keys

GET /v1/api-keys — shows prefixes and metadata, never the secret.

Revoke a key

DELETE /v1/api-keys/{id} — immediately invalidates it.

Rotate

Create a new key, switch your app over, then revoke the old one.
A leaked key can act on every account in your PlugKit account. Revoke and rotate immediately if one is exposed.

​
Errors

404 is intentionally returned instead of 403 when you request a resource that belongs to another account, so keys can’t probe for existence.