How Ditto's developer credentials work, what they can access, and how to manage them safely.
š” For setup steps, see Dittoās developer hub
What can an API key access?
Dittoās API key grants access to all data in your workspace, including project, library components, variant, variable, and style guides. Keys are not scoped to individual projects or to read-only access, and they can perform delete operations as well as reads and writes.
A key is also a bearer credential: anyone who has the value can use it, and its access isn't limited to the person who created it.
š” Treat an API key as a workspace-wide credential with full read and write access
Do API keys expire?
No. An API key stays valid until you revoke it. There's no automatic expiry and no forced rotation.
How do I revoke an API key?
Go to the Developers page in the web app
Find the key under API Keys
Open the ā¦ menu and click Revoke key
How do I rotate an API key?
Since API keys don't expire, rotate them on a schedule your internal credential policy requires.
Create a new API key on the Developers page
Update your pipelines, agents, and CLI configuration to use the new key
Confirm your integrations are working
Revoke the old key
š” Use a separate key per integration or environment so you can rotate one without disrupting the others.
Can I restrict API access to specific IP addresses?
Ditto does not currently support IP allowlisting. API requests are authenticated by key alone and accepted from any source address.