Skip to main content
Sazabi has two kinds of keys. Use the right one for the job:
  • Public keys — project-scoped, for sending data in (log ingestion via OTLP, webhooks, and the browser SDK). They can only write telemetry, so they are safe to ship in clients. Prefixed sazabi_public_.
  • Secret keys — organization-scoped by default (a key can also be scoped to a single project), for reading and writing the API (the API, the CLI, and the MCP server). They grant full read/write access, so keep them server-side. Prefixed sazabi_secret_.
Sazabi has no “API keys” — a credential is either a public key or a secret key. For sending data in, you normally use your intake URL (from Settings > Log streams), which has your public key embedded in it — you rarely handle the raw public key. This page is for managing the underlying keys when you need to: viewing them, rotating, or deactivating.

​
Choosing the right key

​
Create a public key

Public keys are provisioned when you set up a log source, not created standalone.
  1. Go to Settings > Public keys (project-scoped) to view and manage the keys your project already has.
  2. To provision a new one, connect a log source (see Instrument); the setup flow creates the key for that source.
  3. Copy a key’s value where the flow shows it — it is displayed only once. Store it in your secret manager or platform environment.
There is no sazabi public-keys create command — bare public-key creation is intentionally not exposed; keys are provisioned through log-source setup. From the CLI you can list existing keys and manage their lifecycle (verify against /reference/cli):

​
Create a secret key

  1. Go to Settings > Secret keys (organization-scoped). You need owner or admin access.
  2. Create a key and name it for its use, such as ci-automation or mcp-server.
  3. Copy it immediately — the full value is shown only once.

​
Rotate and revoke

Both key types can be rotated and revoked. To rotate a secret key, create a new one, move your clients to it, then revoke the old one. To rotate a public key, set up a replacement log source connection and retire the old one. Revocation is immediate: any client still using a revoked key loses access at once. Keep keys out of source control.

​
Verify

  1. Connect a log source to provision a public key, then send a test log with it (see Instrument); the log should appear in the project.
  2. Create a secret key, then run sazabi auth whoami after authenticating with it — it should report your organization and project.
If a request is rejected as unauthorized, confirm you are using the right key type for the surface and that the key has not been revoked.

​
Further reading

Instrument

Use a public key to ingest logs.

CLI reference

Authenticate the CLI with a secret key.