The API key object

An API key lets a program call the Summerbase API on behalf of one project, with a role in it. A key that writes is bound to a source, which everything it writes is attributed to. Its secret is shown once, when it is created.

Attributes

idstring (UUID)
The API key’s unique identifier. Not its secret.
objectstring
The object’s type, always api_key.

Always api_key
created_attimestamp
When the key was issued.
last_used_attimestamp
When the key was last used, to the nearest minute, or null if never.
namestring
What the key is for, so it can be recognised in a list.
prefixstring
The start of the secret, which is not itself secret. Enough to tell two keys apart in a list.
project_idstring (UUID)
The project the key is scoped to.
project_roleenum
What the key may do in its project. writer can send data as well as read it, which is what an SDK needs; viewer can only read.

One of viewer, writer, admin, owner
sourceobject
The custom source everything this key writes is attributed to. Required for a writer; a viewer may leave it unset and reads properties as the Summerbase source. Expandable.
Show 18 child attributes
- idstring (UUID)
  The source’s unique identifier. Records are identified by its slug.
- objectstring
  The object’s type, always source.
  
  Always source
- connected_attimestamp
  When a provider source was given its credential, or empty: a provider source that has not been connected yet or has been disconnected, and every source that is not a provider’s.
- created_attimestamp
  When the source was added.
- import_failed_attimestamp
  When the last import gave up, or empty when none has since the last one succeeded. The source’s log says why.
- import_progressdecimal string
  How far the running import has got, from 0 to 1, or empty while it does not know yet.
- import_started_attimestamp
  When the import now running began, or empty when none is. Every metric that reads this source’s records is incomplete until it ends.
- import_stepstring
  What the running import is doing, in a sentence: Importing customers, 1,240 of 8,100.
- imported_attimestamp
  When the last import finished, or empty when none has.
- namestring
  What the source is called, for people reading a screen.
- priorityinteger
  Where this source sits when resolving name and email. Lower wins, and the project’s own source starts at the top so a manual correction outranks a provider sync. It orders nothing else — every other property is namespaced by source and never arbitrated.
- project_idstring (UUID)
  The project the source belongs to.
- provider_account_idstring
  The provider’s own id for the account the source is connected to: acct_… for Stripe. Kept through a disconnect, so that connecting again is checked against it.
- provider_codeenum
  The code of the system the source pulls from. custom is a source you write to yourself, and the only one that accepts writes; stripe is connected with connect_stripe and fetches for itself.
  
  One of custom, stripe, summerbase
- sandboxboolean
  Whether the connection is to the provider’s test mode rather than a live account; empty while nothing is connected.
- slugstring
  How this source’s records are identified — the stripe in stripe:cus_123. Lowercase letters, digits, hyphens and underscores; unique within the project and fixed once the source exists, because integrations hard-code it. A reference shaped like an id is read as one, so a slug may not look like a UUID.
- webhook_installed_attimestamp
  When the provider’s webhook was installed for this source — by the connection, or by hand and registered with register_stripe_webhook — or empty: nothing is connected, or the source is connected without a webhook and its changes arrive with the hourly reconcile.
- webhook_urlstring
  Where the provider posts this source’s events: the address of the endpoint a connection installs, and of one to install by hand. Empty for a source whose provider posts no webhooks.
source_idstring (UUID)
The custom source everything this key writes is attributed to. Required for a writer; a viewer may leave it unset and reads properties as the Summerbase source.

Example

{
  "created_at": "2026-02-11T09:15:42Z",
  "id": "0199b2d3-8e4f-7a61-b2c3-7d9e1f4a6c85",
  "last_used_at": "2026-10-19T08:41:00Z",
  "name": "Billing sync",
  "object": "api_key",
  "prefix": "sb_us1_k7hq2mxa",
  "project_id": "0198f1a2-6c52-7b18-8e3f-2a9c4d6b1e07",
  "project_role": "writer",
  "source_id": "0198f1a3-0c18-7d93-a6e2-1b4f9d7c3a58"
}

Endpoints

GET/v1/api_keyGet the current API key