An API key lets a program call the API without your password. Every key belongs to one project and acts only on that project's indices. Send it as a bearer token:
curl https://api.zaproo-search.com/v1/projects/$PROJECT_ID/indices -H "Authorization: Bearer zs_sk_..."
There are two kinds of keys:
zs_sk_…) is for your servers, scripts and AI agents. It can call every project route its access allows, the search and suggest routes, and the MCP server.zs_pk_…) is meant for browsers. It can only call POST /v1/search/<profileKey> and POST /v1/suggest/<suggestKey> for the project's indices, and only from the web origins you list.The browser sends the page's Origin header with every call. A public key used from a server has none and gets 403 ORIGIN_NOT_ALLOWED, so servers use a secret key with read access, limited to the index. See Integrate a storefront.
In the cabinet, open the project's API keys page. Click New key. In the dialog, enter a name, pick the type and the access, list the allowed origins for a public key, and click Create key.
The API keys page
Creating keys needs the admin or owner role and a verified email. Until then New key stays off and the page says why. Only a signed-in person can create keys. A key cannot create other keys.
POST/v1/projects/:projectId/api-keysAdmin or owner with a verified email, not while support is acting as youcurl -X POST https://api.zaproo-search.com/v1/projects/$PROJECT_ID/api-keys \
-H "Authorization: Bearer $ACCESS_TOKEN" -H "Content-Type: application/json" \
-d '{"name": "Storefront server", "kind": "SECRET", "access": "READ", "indexScope": ["'$INDEX_ID'"]}'
The cabinet form sets the name, type, access and allowed origins. Index scope and expiry are set through the API only.
stringValues 1 to 100 charactersWhat the key is for. The name shows in the key list, next to the key's prefix.
SECRET | PUBLICSECRET creates a zs_sk_ key for servers. PUBLIC creates a zs_pk_ key for browsers that can only search and suggest. The type cannot change later. Create a new key instead.
FULL | READDefault FULLFULL can read and change everything in the project: indices, mappings, documents, profiles, synonyms, rules and autocomplete. READ can read all of that and search, but changes nothing. A public key always has READ, whatever you send.
READ key. If the key leaks, nobody can delete your indices with it.FULL key. An agent with a READ key can call only the read tools.READ key on a write route answers 403 FORBIDDEN.index id listDefault [] (every index)Values up to 100 index idsLimits the key to the listed indices of the project. An empty list means every index, including indices created later. To the key, an index outside its scope does not exist. Its routes answer 404 INDEX_NOT_FOUND, it is missing from the index list, and its tasks are missing from the task list. Search and suggest with a profile or suggest key of such an index answer 404 too.
403 INDEX_SCOPED_KEY, because the key could not see the new index.origin listValues up to 50; required for a public keyThe web origins a public key works from. On every request with a public key, the API compares the request's Origin header with this list. A request whose origin is not on the list, or that has no Origin header, answers 403 ORIGIN_NOT_ALLOWED. A secret key ignores the list.
Write each origin as scheme://host or scheme://host:port, in lower case, with no path and no trailing slash. In the cabinet's Create API key form you may type just the domain, shop.example.com or *.shop.example.com, and it is saved as its https:// origin in lower case. Type http:// origins, such as http://localhost:3000, in full:
| Entry | Matches | Does not match |
|---|---|---|
https://shop.example.com | https://shop.example.com | https://www.shop.example.com, http://shop.example.com |
https://*.shop.example.com | https://www.shop.example.com, https://eu.m.shop.example.com | https://shop.example.com |
http://localhost:3000 | http://localhost:3000 | http://localhost:3001 |
In the cabinet, enter one origin per line.
https://shop.example.com and its subdomains, list both https://shop.example.com and https://*.shop.example.com.http://localhost:3000 separately for local development, and keep it off production keys.Origin header from a script, so they stop other websites, not scripts.ISO 8601 date-timeDefault none (never expires)The moment the key stops working. After it, every request with the key answers 401 API_KEY_EXPIRED. Leave it out for a key that never expires.
{ "name": "Agency access", "kind": "SECRET", "access": "READ", "expiresAt": "2026-12-31T23:59:59Z" }
The answer to a create request is the only time the full key appears. The cabinet shows it in a box with Copy key. Copy it into your secret store before you click I have saved it. Zaproo stores only a hash of the key and its first 14 characters, the prefix you see in the list, for example zs_sk_Ab3dE9xQ….
If you lose a key, revoke it and create a new one.
/v1/projects/:projectId/api-keysAny member of the organizationThe list shows each key's name, prefix, type, access, allowed origins and status. Through the API, each key also has its indexScope, expiresAt, revokedAt, createdAt and lastUsedAt. lastUsedAt is updated about once a minute, not on every request.
Click Revoke in the key's row. The key stops working at once. The very next request with it answers 401 API_KEY_REVOKED. A revoked key stays in the list with the status Revoked, and it cannot be turned back on.
/v1/projects/:projectId/api-keys/:keyIdAdmin or owner of the organizationRevoking a key that is already revoked answers 204 again and changes nothing.
lastUsedAt stopped moving, then revoke the old key.Origin header. The API answers 403 ORIGIN_NOT_ALLOWED. Add -H "Origin: https://shop.example.com" with one of the key's origins.https://shop.example.com/ and https://shop.example.com/search are refused with 400 VALIDATION_FAILED. Write https://shop.example.com.