API Key Management

API Keys are credentials for calling the Profy Platform API. This page explains how to manage API Keys in the Platform Console.

Creating an API Key

Access the Platform Console

Navigate to API Keys

Click API Keys in the left sidebar.

Create a New Key

Click the Create API Key button and fill in the following:

Name: Give the key a descriptive name (e.g., “Production Backend”, “Data Analysis Script”)
Scopes: Select the endpoint scopes the key can access
Expiration: Choose the key’s expiration period (30 days / 90 days / 1 year / never expires)

Save the Key

After confirming, the system will generate an API Key prefixed with sk-pro-.

The API Key is displayed only once at creation time. Once you close the page, you will not be able to view the full key again. Save it immediately in a secure location (such as a password manager, environment variable, or secrets management service).

Scopes

When creating an API Key, you can select its permission scopes:

Scope	Description	Accessible Endpoints
`all`	Full access	All `/v1/*` endpoints
`events:write`	Event write access	`/v1/agents/run`, `/v1/chat/completions`, `/v1/models`, `/v1/events`

Follow the principle of least privilege — only grant the permissions the key actually needs.

Viewing API Keys

On the API Keys page, you can see a list of all created keys:

Field	Description
Name	Descriptive name of the key
Key Prefix	`sk-pro-xxxx...` (only the first few characters are shown)
Created At	Date the key was created
Expires At	Expiration date (if applicable)
Status	Active / Expired / Revoked

Revoking an API Key

When a key is no longer needed or may have been compromised, revoke it immediately:

Find the Target Key

Locate the key you want to revoke in the API Keys list.

Click Revoke

Click the delete/revoke button next to the key.

Confirm Revocation

Confirm the action. Revocation is irreversible — the revoked key will be invalidated immediately and cannot be restored.

After revoking a key, all requests using that key will immediately return 401 Unauthorized. Make sure to update all services using the key before revoking it.

Secure Storage

Using Environment Variables

# .env file (do not commit to version control)
PROFY_API_KEY=sk-pro-your-key-here

import os
from profy import Profy

client = Profy(api_key=os.environ["PROFY_API_KEY"])

import { Profy } from "@profy-ai/sdk";

const client = new Profy({
  apiKey: process.env.PROFY_API_KEY!,
});

Using a Secrets Management Service

For production environments, we recommend using your cloud provider’s secrets management service:

AWS Secrets Manager
Tencent Cloud SSM
HashiCorp Vault

import boto3

def get_profy_key():
    client = boto3.client("secretsmanager")
    response = client.get_secret_value(SecretId="profy/api-key")
    return response["SecretString"]

Security Best Practices

Do not use API Keys in frontend code

Browser-side JavaScript code is visible to users. If your App needs to call the Profy API from the frontend, use the OAuth flow to obtain a user-level token, or proxy requests through your own backend.

Do not commit keys to version control

Store keys in .env files and add .env to .gitignore. In CI/CD environments, use a secrets management service for injection.

Set an expiration time

Set a reasonable expiration for your keys. For testing purposes, use 30-day expiration; for production, use 90-day or 1-year expiration with regular rotation.

Audit and rotate regularly

Periodically review your API Keys list and revoke any that are no longer in use. For long-running services, establish a rotation schedule (e.g., rotate keys quarterly).

Monitor for anomalous usage

Monitor API call volume in the Platform Console’s Usage Stats and Call Logs. An unexpected spike may indicate a key compromise.

Call Logs

Every API Key call is logged. On the Call Logs page of the Platform Console, you can:

Filter by key: View call records for a specific key
Filter by status code: Find failed calls
Filter by endpoint: View calls to a specific API
View details: Expand to see request and response summaries

Rate Limits

API Keys are protected by rate limits. When the limit is triggered, the API returns 429 Too Many Requests. We recommend implementing exponential backoff retry in your client:

import asyncio
from profy import Profy, ProfyApiError

async def call_with_retry(client, max_retries=3):
    for attempt in range(max_retries):
        try:
            return await client.agents.run("my-expert", "你好")
        except ProfyApiError as e:
            if e.status_code == 429 and attempt < max_retries - 1:
                wait = 2 ** attempt
                await asyncio.sleep(wait)
                continue
            raise

Desktop Auto-Configuration

The Profy Desktop client automatically creates an API Key named “Profy Desktop” upon first login. This process is transparent to the user and requires no manual action.

Overview

Platform API

Authentication & Keys

Integrations

SDK

Cookbook

Reference

API Key Management

Creating an API Key

Scopes

Viewing API Keys

Revoking an API Key

Secure Storage

Using Environment Variables

Using a Secrets Management Service

Security Best Practices

Call Logs

Rate Limits

Desktop Auto-Configuration

Next Steps

Authentication Guide

Platform Console

​Creating an API Key

​Scopes

​Viewing API Keys

​Revoking an API Key

​Secure Storage

​Using Environment Variables

​Using a Secrets Management Service

​Security Best Practices

​Call Logs

​Rate Limits

​Desktop Auto-Configuration

​Next Steps

Authentication Guide

Platform Console

Creating an API Key

Scopes

Viewing API Keys

Revoking an API Key

Secure Storage

Using Environment Variables

Using a Secrets Management Service

Security Best Practices

Call Logs

Rate Limits

Desktop Auto-Configuration

Next Steps