API Keys

API keys authenticate Socket and REST clients. Format:

<publicId>:<secret>

The secret is shown when the key is created — store it securely. The public id is used in token routes (/v1/key/:keyID/...).

Tasks

1. Open a project → API Keys.
2. Create a key; optionally set a permission map.
3. Copy the full key once and store it in your secret manager.
4. Update permissions or metadata as needed.
5. Delete compromised or unused keys.

Permissions

When creating or editing a key, Cloud shows checkboxes for each action:

• publish — publish messages to channels
• subscribe — subscribe to channels (does not grant _stats / _logs)
• enqueue — enqueue jobs on queues
• dequeue — pull, ack, and nack jobs
• stats — subscribe to the _stats platform channel
• logs — subscribe to the _logs platform channel

Resource restriction

By default, a key has access to all resources (*). To restrict it, choose Selected resources and enter channel or queue names.

Queue resources use the queue: prefix — for example queue:emails restricts enqueue/dequeue to the emails queue. Channel names are matched directly (for example notifications).

See Permissions for the full reference.

Using the key

const rest = new QPub.Rest({ apiKey: process.env.QPUB_API_KEY });
const socket = new QPub.Socket({ apiKey: process.env.QPUB_API_KEY });

For browsers, do not embed the secret. Issue a JWT or token request from your backend instead.