API keys

API keys let you access the Blecon APIs programmatically, from scripts, server-side applications, or integrations, without using a browser login.

Creating an API key

From Blecon Track:

Open Workspace Settings and go to the API tab.
Enter a name and click Create.
The secret key is shown immediately. Copy it now: it cannot be shown again.

If you need to rotate a key, generate a new key. Delete the old one to invalidate its secret.

What a key can access

An API key gives access to the API:

API	What it covers	Reference
API	Assets, zones, rules, alerts, webhooks, workspace members	api.blecon.net/tracker/docs

The key is scoped to the account it was created in and gives access to all Track workspaces in that account. It cannot access other accounts or their workspaces.

Using an API key

Include the key in the Authorization header of your API requests:

Authorization: APIKEY::<your-secret-key>

Key properties

Property	Value
Permission level	Full account access (owner level)
Account scope	Locked to the account that created it
Lifetime	365 days from creation
Max keys per account	10

Security

Store keys securely; treat them like passwords.
API keys cannot access other accounts, even if the creating user is a member of multiple accounts.
Deleting a token immediately revokes access for all secrets generated from it.

API keys vs browser authentication

Method	Use case
Browser login	Interactive Track access
API keys	Scripts, automations, server-to-server integrations

Both methods access the same API endpoints. API keys are scoped to a single account; browser sessions can switch between accounts.

API