API keys

Every source has one API key — the credential that authorizes data into that source. Keys are per-source, so you rotate or revoke one without touching the others.

Where the key is used

Agent sources (Kubernetes/Docker). The key is embedded at install time. On Kubernetes it lives in the observekit-agent Secret (api-key) in the observekit namespace; the DaemonSet reads it via secretKeyRef. On Docker it's the OBSERVEKIT_SERVER_API_KEY env var.
Service sources (OpenTelemetry). Your app sends the key on every OTLP request as X-API-Key: <key> or Authorization: Bearer <key>. See Sending data with OpenTelemetry.

Finding the key

The key is shown when you create the source (the install dialog) and on the source detail page. Hand it to whoever configures the app or installs the agent.

Install link vs. API key — not the same thing

The install link (/install/<token>) is a short-lived bootstrap URL (valid 24 hours) that renders the full agent manifest with the key baked in. Use Regenerate Install Link on the source when it expires or you need a fresh install command. Regenerating the link does not change the source's API key.
The API key is the long-lived credential itself. Rotating it is a separate, admin-level action.

Rotating a key

Rotating issues a new key and invalidates the old one. After rotation, update every consumer or it stops sending:

Agent (K8s): update the observekit-agent Secret and restart the DaemonSet, or just re-run a fresh install command.
Agent (Docker): re-run docker run with the new key.
OTel apps: update OTEL_EXPORTER_OTLP_HEADERS (or wherever the key is set) and restart.

Rotate when a key may have leaked (e.g. it was committed to git — treat that key as compromised).

Revoking access

Deleting the source stops it accepting any new data — the definitive revoke. Historical data already collected stays queryable. An OTel app using a deleted/rotated key gets 401 Unauthorized.

Good practice

One source per app/cluster so access is independently revocable.
Never commit keys. Inject them from a Secret / secret store, not source control. In config files, reference an env var (e.g. ${OBSERVEKIT_API_KEY}) rather than the literal key.
A key only grants write into its own source — it can't read data or touch other sources.