API keys

TL;DR — Settings → API & webhooks → Create key. Copy the key immediately; it is shown once. Lock it to one channel if you can.

#Create a key

1. Open Settings → API & webhooks.
2. Give the key a name you will recognise later — Studio A Companion, not key 2.
3. Pick a role. It caps what the key can do, the same way a person's role does.
4. Tick the permissions it needs.
5. Optionally lock it to a single channel.
6. Click Create key.

Admins and owners only.

#Permissions

Tick nothing and the key is limited only by its role. Tick read alone and you have a key that can build a status display but cannot touch the show.

A key can never be created with more than its creator holds — not a higher role, not permissions you don't have, not a different channel.

#Lock keys to a channel

Anything installed in a rack, on a shared machine, or in a venue you don't control should be locked to one channel.

A locked key can only see and drive that channel. It cannot list your other channels, read their state, or play anything on them.

#Keys belong to the organisation

Not to the person who made them. A panel wired into a rack keeps working after the person who set it up has moved on, which is what you want from installed hardware — and it means offboarding somebody does not silently kill a show two months later.

The trade is that removing a person does not revoke their keys. So keys are named, listed, and show when they were last used. Before revoking one, that last-used date tells you whether anything still depends on it.

#Revoke a key

Click Revoke next to it. It stops working immediately — mid-request, not at the end of some session.

Revoke a key when:

• The device it lived on is gone, sold, or repurposed
• It was pasted somewhere it shouldn't have been — a chat, a screenshot, a public repository
• It shows as never used, weeks after you made it

Revoked keys stay in the list rather than disappearing, so you can still see what existed.

#Keeping a key safe

The key is a password for your channels. Anything holding it can put graphics on air.

• Put it in an environment variable or your control software's credential field, never in a file you commit.
• Don't paste it into a support ticket or a screenshot. If you already have, revoke it and make another — that costs a minute.
• Give each device its own key. Then revoking one doesn't take down the other three.
• Set an expiry for anything temporary, like a key for a single event weekend.

Our keys all start with qv_. That prefix is deliberate: secret-scanning tools recognise it, so a key committed to a repository gets flagged rather than sitting there.

#Next steps

• The Quadraviz API — What you can call
• Webhooks — Get told when something changes on air