Authentication
A workspace API key, sent as a bearer token.
Create a key
In the dashboard, a workspace administrator opens Workspace settings → API keys and chooses New API key. A key needs:
- a short description of what it is for, so you know later where it is used;
- an expiry: never, or after 30 days, 90 days or a year. An expired key stops working on its own;
- what it may do; see Authorization.
The key starts with wpo_ and is shown once, right after it is made. Copy it into the integration's configuration then. WP Octo keeps only a fingerprint of the key, cannot show it again and cannot recover it; if a key is lost, revoke it and make a new one.
A key identifies the workspace, not a person, and keeps working when the person who made it leaves the workspace. The list of keys shows each key's description, its first and last few characters, what it may do, who made it, when it was last used and when it expires — never the key itself.
Revoke a key
Revoke a key from the same page. It stops working at once, for every integration that uses it. Revoking a key does not affect your WordPress sites.
Keys made before keys were shown once keep working. Their full value can no longer be shown; the list names them as an existing key.
Send it
Every request carries the key as a bearer token:
GET /api/v1/dashboard/websites HTTP/1.1
Host: wpocto.com
Accept: application/json
Authorization: Bearer <your key>A request without a valid key — missing, revoked or expired — is answered with 401.
Keep it where it belongs
The key opens this platform. It does not belong on a managed WordPress site, in a browser, or in a repository. A site holds a different credential — the workspace token — for a different purpose, and the two are not interchangeable; see Secrets.
From the reference pages
The API reference lets you try each operation from the page. Enter your key once in the authorization field; it is used for the requests you make from that browser and is not stored by the documentation site.