One key. Visible once.
Robert Reiz | October 22, 2026 | 05:47 UTC Lena looks after her agency's integrations. Six months ago she created an API key in ZEIT.IO for the accounting software, and a second one for the reporting tool. Whenever a new service provider builds a connection, she opens the settings, clicks "show", copies the key and sends it on.
Convenient – and that's exactly the problem. A key you can display again at any time has to be stored somewhere in clear text. Anyone who glances at Lena's screen for a few seconds can read it. And every API key is a master key to exactly the data it was given access to: invoices, customers, time records.
From now on, ZEIT.IO no longer stores your organisation's API keys in clear text. You see a new key exactly once – right after you create it.
What changes now
The key is shown only once
Under Settings → API Keys you create a key with "Add API key", as before. Right afterwards it appears above the list – with an icon that copies it to the clipboard in one click, and with this notice:
"This API key is shown in clear text only now. Copy it and keep it somewhere safe - it cannot be displayed again."
As soon as you leave or reload the page, the clear text is gone. It's the way you know it from AWS, GitHub and other services that hand out access.
The list shows only the end of the key
Instead of the key, the overview now shows •••• followed by its last four characters. That's enough to tell which key sits in which integration. There's a new "Created" column. The buttons to show and copy a key in the list are gone.
Only a fingerprint is stored
To check a request, ZEIT.IO doesn't need the key itself. What it stores is a so-called hash – a fingerprint the key can't be worked out from – plus an encrypted copy. The key no longer sits anywhere in the database in clear text.
No key unless you ask for one
Until now, ZEIT.IO automatically created a key called "Default" with full permissions the first time someone opened the API Keys page – whether it was needed or not. Not any more. A new organisation now sees an empty list there. An API key is only created when a person creates it on purpose – because only then does someone get the chance to copy it.
We have removed the automatically created default keys that were never called. Each of these deletions is recorded in your organisation's audit log.
What stays the same
- Your existing integrations keep running. Every API key already in use stays valid. You don't have to replace anything.
- Permissions, expiry date and the active switch work as before.
- Your personal API token in your user settings is not affected by this change yet.
And if a key gets lost?
Then you create a new one, enter it in the integration and deactivate the old one. It takes a minute – and it's the right thing to do anyway when you're no longer sure where a key has ended up.
Why this matters
An API key opens the door to your invoices, customers and time records – no password, no second factor. The less often it shows up in clear text, the smaller the risk of it falling into the wrong hands: through a glance at a screen, a screenshot or a copy of the database.
In your day-to-day work, hardly anything changes. You copy the key once, when you create it – and from then on only you and your integration know it.
One key. Visible once. Safely kept after that.