Authentication and API Keys

Overview

API keys are how machines authenticate to PreStartGo — your integration presents a key as a bearer token, and the platform resolves it to your organisation with exactly the permissions the key was scoped to. This article covers the lifecycle: creating, scoping, protecting, rotating, and revoking.

Creating a key

1. 1
   In the console, open Developer → API Keys and choose Generate Key.
2. 2

   Choose its scopes — per-resource read and write grants (equipment read, checks read, defects write, and so on). Grant what the integration needs and nothing more: a reporting sync needs read scopes only.

3. 3

   Optionally set an expiry date. The key works until the end of that day, in your computer's time zone, and every request after that is refused with a 401. Leave it empty for a key that doesn't expire.

4. 4

   Copy the key immediately — it is shown exactly once. The platform stores only a hash; if the key is lost, you create a new one, you don't recover the old one.

Use the key on every request:

Authorization: Bearer psg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Live and test

The key's prefix tells you which world it belongs to at a glance:

The prefix is also what makes an accidentally-committed key findable by secret scanners — one of several reasons not to rename or wrap keys in your own encodings.

What a key is, and isn't

• A key is your organisation, within its scopes — treat it like a credential of that weight.
• A key is not a person. API actions are attributed to the key (by id) in the audit trail, so use separate keys per integration — "the CMMS sync" and "the BI export" should not share one identity.
• A key never crosses tenants. It sees one organisation; other organisations' records 404.
• Some surfaces refuse keys entirely — interactive, human-only operations are deliberately closed to API keys regardless of scope.

Protecting keys

• Store keys in your secret manager — never in code, config files in version control, or client-side applications.
• Scope narrowly, and per integration.
• Prefer psg_test_ keys everywhere outside production.

Rotating and revoking

Rotation is the routine hygiene: create the new key, move the integration to it, revoke the old one — revocation is immediate. Revoke on any suspicion of exposure first and investigate second; a revoked key fails closed everywhere from that moment.

Troubleshooting