How do I create a key?
Integrations, then the API tab. Give the key a name that says where it will be used — "ci-deploy-gate", not "key 2" — choose its scopes, and copy it. The full key is shown once at creation and never again: we store only a SHA-256 hash and a short non-secret prefix, so we cannot show it to you later and neither can anyone who reaches our database.
Every plan can create API keys: 1 on Free, 3 on Starter, 10 on Team.
How long do keys last?
Keys expire 90 days after creation by default, and you can set up to 365. An expired or revoked key is rejected outright. Each key records a last-used timestamp, which is the fastest way to find keys nobody needs any more.
Short expiry is deliberate. A key that never expires is a credential you will still be trusting in three years, held by a system you have forgotten, in a repository you no longer read.
How do I authenticate a request?
Send the key as a bearer token. The API also accepts a session token the same way, which is what the portal itself uses.
curl -sS https://pagelantern.com/api/monitors \
-H "Authorization: Bearer $PAGELANTERN_API_KEY" \
-H "Accept: application/json"What do I do if a key leaks?
Revoke it first, then investigate. Revocation is immediate and does not require the key itself. Create a replacement, deploy it, and only then go and find out how the old one got out.
Tell us at security@pagelantern.com if you believe the exposure involved PageLantern rather than your own systems. Every action taken with a key is in the audit log with the actor, the client IP and the user agent, which is what you will want when reconstructing what the key was used for.