Using API Keys to Access Public APIs

Use a Logfire API key to access the public APIs or send data from your application. The permissions you select determine what the key can do.

If you are building a partner integration that customers connect to their own Logfire resources, use an OAuth app to request consent without asking customers to copy an API key.

Sending data

A key scoped to a specific project can send logs, traces, and metrics when it has the Send telemetry capability (project:write_otlp). An API key without that permission cannot send data. Organization-wide keys must be scoped to a project before this capability is available. Existing write tokens also work; you do not need to replace them.

What you can do

Available to all plans:

• Projects: List, create, update, and delete projects
• Write tokens: Create, list, rotate, expire, and revoke write tokens
• Read tokens: Create, list, rotate, expire, and revoke read tokens
• Alerts: Create, list, update, and delete alerts with SQL-based conditions and notification channels
• Dashboards: Create, list, update, and delete dashboards
• Notification channels: Create, list, update, and delete notification destinations (Slack, webhooks, etc.)
• Variables: Create, read, and update project variables

Enterprise / Self-hosted only:

• Audit logs: List and retrieve audit log entries for your organization
• Billing usage: View billing usage data for current and previous periods
• SCIM provisioning: Discover existing users and synchronize access through mapped identity-provider groups, using the System for Cross-domain Identity Management (SCIM) standard
• Organization management (self-hosted only): Create, list, update, and delete organizations

API Documentation

Complete API reference (Swagger docs):

• US Region: https://api-us.pydantic.dev/api/docs
• EU Region: https://api-eu.pydantic.dev/api/docs

Choose the endpoint that matches your account’s data region.

Creating API Keys

Organization API Key

Navigate to your organization, then Settings → API Keys → New API Key.

Organization API keys can be scoped to all projects or a specific project. See API Key Scopes for available permissions.

Project API Key

Navigate to your project, then Settings → API Keys → New API Key.

Project API keys are limited to the project where they were created.

To send data from your app, select Send telemetry when creating the key. For the Python SDK, use the key as LOGFIRE_TOKEN, just as you would a write token. This permission allows sending data, not reading it or managing project settings. Add other permissions only when your application needs them.

Caution

Copy your API key when it’s displayed. It won’t be shown again.

Personal API Keys

When creating an API key, it can be marked as personal. A personal API key is tied to your user account rather than being a shared project or organization key.

• Automatically deleted when your account is removed from the project or organization.
• Only visible to you: you can only view and delete your own personal API keys.
• Scoped to your permissions: the key can only be granted scopes that your role allows.

Organization and project admins can choose whether to create a personal or non-personal API key. Non-admin members always create personal API keys.

API Key Scopes

When creating an API key, set the scope to define which actions the key can perform. Available scopes depend on whether you’re creating an organization or project API key:

Scope	Organization API Key	Project API Key
Organization management	✓	-
Notification channels	✓	-
Audit logs	✓	-
SCIM provisioning	✓	-
Billing usage	✓	-
Send telemetry (project:write_otlp)	Specific project only	✓
Query telemetry (project:read_otlp)	Specific project only	✓
Project settings	✓	✓
Write tokens management	✓	✓
Read tokens management	✓	✓
Alerts management	✓	✓
Dashboards management	✓	✓
Variables management	✓	✓

Note

Select only the scopes your application needs to follow the principle of least privilege.

Using API Keys

Once you have an API key, you can use it to authenticate requests to the Logfire public APIs. Include the API key in the Authorization header as a Bearer token.

Example: List Projects

Here’s an example using curl to list all projects in your organization:

US Region

Terminal

curl -X GET "https://api-us.pydantic.dev/api/v1/projects/" \
  -H "Authorization: Bearer YOUR_API_KEY"

EU Region

Terminal

curl -X GET "https://api-eu.pydantic.dev/api/v1/projects/" \
  -H "Authorization: Bearer YOUR_API_KEY"

Replace YOUR_API_KEY with your actual API key.

Example Response

A successful request will return a JSON response with your projects:

[
  {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "project_name": "my-project",
    "created_at": "2024-05-24T11:18:22.704455Z",
    "description": null,
    "organization_name": "my-organization",
    "visibility": "public"
  }
]