Coding agents

Personal API keys

Create a key that reads your logs, metrics, monitors and analytics from scripts and coding agents, limited to the scopes and domains you pick.

A personal API key acts as you outside the browser: in a script, a CI job or a coding agent. You decide what it can read or change, which domains it reaches and when it expires. It is a different key from the ingest key your apps send logs with. See Keys and IDs.

Create a key

Open API keys Open the account menu at the bottom of the sidebar, choose API keys and press New key.
Name it Enter a Label that says where the key lives, such as CI release job or My laptop. You see it in the list of keys later.
Pick scopes Under Scopes, give each area the least access the job needs. Every area starts at Read, except Account.
Pick access Under Access, choose Everything, a set of Domains, or a set of apps under Services.
Pick an expiry Choose 30 days, 90 days, 1 year or No expiration, and press Create key.
Copy the key Logdash shows the key once. Copy it into your secret store or an environment variable, such as LOGDASH_PERSONAL_KEY.

Logdash keeps only a hash of the key. If you lose it, revoke it and create a new one.

Use a key

Send the key in the Authorization header of every request. To check a key and see what it can do, call whoami:

curl https://api.logdash.io/personal-api-keys/whoami \
  -H "Authorization: Bearer $LOGDASH_PERSONAL_KEY"

Response

{
  "userId": "6650f1c2a3b4c5d6e7f80912",
  "scopes": [
    { "resource": "logs", "action": "read" },
    { "resource": "monitors", "action": "read" }
  ],
  "access": { "kind": "clusters", "ids": ["6650f1c2a3b4c5d6e7f80a01"] }
}

The HTTP API lists what you can read with it, and the MCP server takes it too.

Scopes

Each scope gives one area of your data an access level. A higher level includes the ones below it, so Write can also read.

Scope	Levels	What it allows
Logs	Read	Read and search logs, and follow them live.
Metrics	Read	Read metrics and their history.
Monitors	Read, Write, Delete	Read reads monitors and their checks. Write adds and edits monitors. Delete also deletes monitors and their history.
Services	Read	List the apps of a domain.
Domains	Read	Read the overview of your domains and their ingest keys.
Web analytics	Read, Write	Read reads your analytics. Write also saves, edits and removes insights.
Account	Read	Read your account.

A request that needs a scope the key lacks answers 403 with a message such as Missing scope logs:read. Endpoints that no scope covers, such as billing and creating keys, answer 403 to every personal API key.

Access

Access	The key reaches
Everything	Every domain you are a member of, including domains you join later.
Domains	Only the domains you check.
Services	Only the apps you check, in their domains.

Access never goes beyond your own membership. If you leave a domain, your keys stop reaching it. A request for a domain outside the key answers 403 with "Personal API key is not scoped to this domain or service".

Revoke a key

In API keys, press the trash button of the key and confirm with Revoke key. Anything that uses the key stops working at once. The list also shows when each key was last used and when it expires, so you can find keys nobody uses.

Coding agents that sign in through the browser get a key of their own, labelled MCP (<client>). It expires after 30 days, and you revoke it in the same list.

Keep keys safe

Give each script or agent its own key, so you can revoke one without breaking the others.
Prefer an expiry over No expiration, and Read over Write.
Keep keys out of code and out of the browser. A personal API key can read every domain it reaches.