For the complete documentation index, see llms.txt. This page is also available as Markdown.

API Keys

Generate and use API keys for programmatic access.

API keys provide machine-to-machine access to the Duku platform.

Each key is an OAuth2 client pair: client_id and client_secret. Exchange that pair for a short-lived Bearer token, then use the token against the GraphQL API.

Limits and scope

  • Keys are scoped to one organisation

  • Each organisation can have up to 10 active keys

  • Keys expire after 90 days by default

  • Only Admins can create, rotate, or revoke keys

Generate a key

  1. Open Settings → API Keys in Viewport

  2. Click Generate API Key

  3. Enter a label like GitHub Actions or CI Pipeline

  4. Click Generate

  5. Copy the Client ID and Client Secret

Exchange the key for an access token

Example response:

expires_in is returned in seconds. In the example above, the token lifetime is 5 minutes.

Use the access token

Rotate a key

  1. Open Settings → API Keys

  2. Click Rotate on the key

  3. Update the new secret in your CI system

  4. The previous secret is invalid immediately

Revoke a key

  1. Open Settings → API Keys

  2. Click Revoke

  3. The key is deleted permanently

Best practices

  • Use one key per integration

  • Rotate keys regularly

  • Never commit secrets

Last updated