API Keys

API keys authenticate your SDK and API requests to Zabta. All keys use the zbt_ prefix and are stored as bcrypt hashes — Zabta never stores your raw key.

Generating a key

Go to Settings → API Keys in the dashboard
Click “Generate new key”
Copy the key immediately — it is shown only once
Store it securely (environment variable, secrets manager, or .env file — never commit it to source control)

Using your key

With the Python SDK

python

from zabta import ZabtaClient

client = ZabtaClient(
    api_key="zbt_your_key_here",
    agent_id="your_agent_id"
)

With the REST API

bash

curl -X POST https://api.zabta.ai/api/evaluate \
  -H "Authorization: Bearer zbt_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"action": "send_email", "agent_id": "...", "context": {}}'

As an environment variable (recommended)

bash

# .env file (add to .gitignore)
ZABTA_API_KEY=zbt_your_key_here

python

import os
from zabta import ZabtaClient

client = ZabtaClient(
    api_key=os.environ["ZABTA_API_KEY"],
    agent_id="your_agent_id"
)

Revoking a key

Go to Settings → API Keys, find the key (shown masked as zbt_****...last4), and click Revoke. Revoked keys stop working immediately. Any SDK or API calls using a revoked key will return a 401 Unauthorized error.

Security best practices

Never commit API keys to Git repositories
Use environment variables or a secrets manager
Rotate keys periodically — generate a new key, update your deployment, then revoke the old one
Each team member or environment (dev, staging, production) should use a separate key
Monitor the Action Log in the dashboard to detect unauthorized usage

Key limits by plan

Free

Starter

∞

Pro

SDK Quickstart SDK Reference Manage API Keys