Public API

Who: people with Public API. Open Admin, then API.

People can make API keys for their own scripts and tools. Each key acts as the person who made it, and never does more than their role allows, checked on every call. This tab is where you decide whether keys work on the site at all, and see every one.

Turn the API on or off

Allow API keys on this site is on unless you turn it off. Turned off:

• no key works, and nobody can make one, so AI assistants connected through MCP stop too;
• keys are kept, and work again as soon as you turn it back on.

Turning it off asks you to confirm. Either way, it's recorded in the audit log.

Everyone's keys

Keys lists every key that works on the site: whose it is, its name and the start of the key, what it may do, when it expires and when it was last used. Nobody, you included, can see a whole key again after it's made.

Revoke stops a key at once, whoever made it. Its owner (you too, for your own key) gets an email saying an administrator revoked it, without your name, and can make a new one while the API is on. Owners are also emailed before their keys expire.

Good to know

• Owner's role: a key can't do more than its owner, so changing someone's role changes what their keys can do, straight away.
• Leaving: when someone's Atlassian account is deactivated, their keys stop working.
• Uninstalling the app deletes every key at once, without waiting for the rest of the data.
• Unpaid: while the subscription is inactive, keys can read but not write. People can still make keys with read access only, and revoke keys. The site's switch can't be changed then.
• Audit log: making and revoking keys is recorded, and anything a key changes is recorded as done by its owner, "through the public API" with the start of the key.
• Limits: 60 requests a minute per key, 600 for the site, and 300 worklog and plan changes an hour for the site. Those go to Jira, whose allowance every LogQuill customer shares.