Skip to main content
The Neo API authenticates with an API key — a long-lived secret you create in the dashboard and send as a bearer token on every request. A key belongs to the tenant that created it and carries that tenant’s access, so you never pass a client or tenant id yourself.

​
Create an API key

API keys are created in the dashboard, by an admin, under Roles & Access.
1

Open the API Keys tab

Go to Roles & Access → API Keys. You’ll need the Admin role — only admins can manage keys.
2

Create the key

Click Create API key, give it a recognisable name (e.g. Billing export script), and optionally set an expiry. Leave the expiry blank for a key that never expires.
3

Copy it now

The key is shown once, right after creation. Copy it and store it somewhere safe — you can’t retrieve it again later.
Your API key is shown only once and can’t be recovered. If you lose it, rotate or revoke it and issue a new one. Anyone with the key can act on your tenant through the API, so treat it like a password.
A key looks like this — neo_sk_, the environment, then a random secret:

​
Authenticate a request

Send the key in the Authorization header as a bearer token:
That’s the only credential a request needs. The key resolves to your tenant on Neo’s side — there is no separate tenant or client header.

​
Rotating and revoking keys

Manage existing keys from the same API Keys tab:
Use one key per integration and name it for that integration. That way you can rotate or revoke a single consumer without touching the others, and the Last used column tells you which keys are still live.

​
Security best practices

  • Store keys in a secrets manager or your platform’s environment configuration — never commit them to source control.
  • Don’t embed keys in browsers, mobile apps, or anything a customer could inspect — the API is for server-to-server use.
  • Rotate on a schedule, and immediately if a key may have leaked.
  • Set an expiry on keys meant to be short-lived.
Keys can’t create other keys — minting and rotating keys is an admin-only dashboard action. The dashboard itself signs in with your Microsoft account rather than an API key; API keys are for your own scripts and integrations.

​
What’s next

Make your first request

List your agents and read the response envelope.