API Keys
API keys let you access the Sentro REST API programmatically. Use them to automate monitor management, build custom integrations, pull data into dashboards, or integrate with CI/CD pipelines.
Creating a key
- Go to Settings > API Keys in the dashboard.
- Click Create API Key.
- Give the key a descriptive name (e.g., "Production Backend", "CI/CD Pipeline").
- Choose an access level.
- Optionally set an expiration date.
- Copy the key immediately -- it is shown only once.
API keys follow the format sentro_sk_live_xxxxxxxx.
Access levels
| Level | Can do |
|---|---|
| Read Only | List monitors, view checks, read incidents. Cannot create, update, or delete anything. |
| Read & Write | Full access -- create monitors, manage alerts, acknowledge incidents, and more. |
Use read-only keys wherever possible. If an integration only pulls data, there is no reason to give it write access.
Key lifecycle
| Status | Meaning |
|---|---|
| Active | Valid and usable. |
| Expired | Past its expiration date. Returns 401 on use. |
| Revoked | Permanently disabled by a team member. Cannot be restored. |
The dashboard shows lastUsedAt for each key so you can identify unused keys.
Security best practices
- Rotate regularly -- Generate new keys every 90 days and retire old ones.
- Use environment variables -- Never hard-code keys in source code.
- Create purpose-specific keys -- Separate keys for production, staging, and CI/CD.
- Set expiration dates -- For temporary integrations or third-party access.
- Revoke compromised keys immediately -- If a key appears in a commit or log, revoke it and create a new one.
Zero-downtime rotation
- Create a new key.
- Update your application to use the new key.
- Verify the new key works in production.
- Revoke the old key.
Rate limits
Rate limits are enforced per API key and vary by plan:
| Plan | Read (GET) | Write (POST/PATCH/DELETE) |
|---|---|---|
| Free | 60 req/min | Read-only (no writes) |
| Starter | 120 req/min | 30 req/min |
| Pro | 300 req/min | 30 req/min |
| Max | 1,000 req/min | 100 req/min |
When the limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header.