Support
Changelog
Back to All
Deprecated

Deprecating API Keys in Favor of Bearer Tokens

12 days ago by Duncan Mapes

We're deprecating API Key authentication across the DevGrid API in favor of Bearer Token authentication. This affects all API keys used via the x-api-key header, on all endpoints where they're currently accepted.

What's changing

  • API keys (x-api-key header) are now deprecated and will be removed in a future release.
  • Bearer tokens are now the recommended and supported authentication method for all API access — REST and GraphQL alike.
  • No immediate action is required, but we strongly recommend migrating now to avoid disruption when API keys are removed.

Why we're making this change

Bearer tokens are tied to an individual user (or service account) identity, which gives you:

  • User-level audit trails — actions are attributed to a specific person or service account, not just an account.
  • Stronger security posture — short-lived, expiring tokens instead of long-lived static keys.
  • A single, consistent auth model across our entire API surface.

Timeline

  • Today: Both API keys and Bearer tokens are accepted on REST endpoints. Bearer tokens are already required on our GraphQL and MCP endpoints.
  • Future release: API keys will be fully removed. We'll announce the exact removal date in an upcoming changelog entry with advance notice.

How to migrate

Replace your x-api-key header with an Authorization: Bearer <token> header.

  1. Request an access token:
curl --request POST \\
  --url https://auth.devgrid.io/oauth/token \\
  --header 'content-type: application/json' \\
  --data '{
    "grant_type": "password",
    "username": "YOUR_EMAIL",
    "password": "YOUR_PASSWORD",
    "audience": "https://api.devgrid.io",
    "client_id": "<CLIENT_ID>",
    "scope": "openid profile email"
  }'
  1. Use the returned access_token on every request:
curl --request GET \\
  --url https://prod.api.devgrid.io/entities \\
  --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIs...'

Full setup details, SDK examples, and SSO/service-account guidance are in our API Authentication guide.

Need help?

If you have a large or automated integration relying on API keys and need migration support, reach out to your DevGrid account team or contact support.