Getting an API key

Every request to the REST API is authenticated with an API key. You create and manage keys inside the Monument app, not through the API itself.

Create a key

Open Settings and choose API Keys. Creating keys is limited to organization admins. If you do not see the section, ask an admin to create a key for you or grant you admin access.

• Give the key a name that describes where it will be used, such as "Billing sync".
• Monument shows the full secret exactly once, at creation. Copy it immediately and store it in your secret manager.
• Keys are prefixed with monument_. Monument stores a one-way hash for validation and only the visible prefix for identification, so the secret cannot be shown again.

Send the key

Attach the key to every request using either header form. Both are equivalent, so pick whichever fits your HTTP client.

X-API-Key: monument_xxxxxxxxxxxxxxxxxxxx

# or, equivalently:

Authorization: Bearer monument_xxxxxxxxxxxxxxxxxxxx

A minimal authenticated request looks like this:

curl 'https://api.monument.so/api/v1/projects' \
  -H 'X-API-Key: monument_your_api_key'

Permissions are bound to the key's creator

A key acts as the person who created it. Requests can read and write exactly what that user can, and are blocked from everything else. Create keys under a user whose access matches what the integration should reach, rather than sharing one key across unrelated systems.

Limits and expiry

Each key defaults to 60 requests per minute. When you create a key you can set a custom per-minute limit and an optional expiry date. An expired key stops working automatically.

Revoke a key

Revoke a key from the same API Keys screen at any time. Revocation takes effect immediately: the next request made with a revoked or expired key returns 401 Unauthorized. Rotate keys by creating the replacement first, then revoking the old one once traffic has moved over.