Changelog · September 21, 2026
API keys are stored hashed, and shown once
A database backup that leaks is not a leak of your API key.
By Roger Campos · Last updated: September 2026
TL;DR
Project API keys are now stored the way a password is: as a SHA-256 digest plus a short prefix, shown once when the key is created and never again. Rotating a key keeps the old one working for 24 hours so you can deploy the new one at your leisure, and you can revoke the old one early if it leaked.
Free plan, no credit card. 1,000 credits a month.
Keys used to be readable in the dashboard on every visit. That is useful exactly once — when a key is lost — and a liability every other day. They are now kept as a digest, so nobody who can read our database can spend your month. New keys start with up_key_, so a person, a log or a secret scanner can recognise one.
Existing keys kept working without anyone doing anything: the digest was derived from the keys already issued.
Losing a key
Rotation
Because a key can't be read back, rotating one opens a 24-hour window in which the key it replaced still authenticates. Rotate, deploy the new key, then — if the reason for rotating was a leak — revoke the previous one to close the window early.
FAQ
Frequently asked questions
Can I see my API key again after creating it?
Does rotating a key break my running integration?
How can I recognise a URLpipe key in a log?
Try it on the free plan.
Free plan, no card. Confirm your email and your API key is live — you'll be making real requests in minutes.