September 3, 2026 IAM

Personal API Keys Retired

Personal API keys and their creation UI are gone. Use scoped OAuth access tokens instead, which limit exactly what a token can do rather than acting with a user's full permissions.

Personal API keys granted whatever access the creating user had, with no way to narrow that down. If a key leaked, so did everything that user could touch. Probo has removed the personal API key creation UI and its GraphQL mutation for that reason.

Scoped OAuth access tokens are the replacement. They only carry the specific permissions you grant at creation, so a token built for reading documents can’t also delete users. Existing personal API keys keep working for now, but new integrations should use OAuth tokens going forward.

It’s a smaller surface to worry about if something goes wrong, and it matches how most API providers handle this today.