Manage and Disable Personal API Keys Directly from Backlog

Hello from the Backlog Development Team!

Thank you for being a valued Backlog user.

Starting Tuesday, November 24, 2026, space administrators will be able to view and manage all personal API keys issued within their space. This new feature allows administrators to instantly review active keys and disable any that are obsolete or unneeded.

In addition, we are updating the “API Settings” page under “Personal Settings.”

Overview of the New Features

View and Disable Personal API Keys

Space administrators can now view a comprehensive list of personal API keys issued by space members and revoke access whenever necessary.

Updates to the “API Settings” Page

To enhance security, the full API key will be displayed only once immediately upon generation. After that, keys will be partially masked across the interface.

Newly generated personal API keys will begin with the prefix backlog_pak_, making them easy to identify as Backlog credentials. Previously issued keys will display only their first four and last four characters (e.g., 1234…abcd).

Eligible Plans

• Viewing and Disabling API Keys: Premium Plan
• API Settings Page Updates: All plans

Release Date

Tuesday, November 24, 2026

Background & Objectives

Credential leaks involving API keys and access tokens have increasingly become the source of critical security incidents. As teams rely more on automated workflows and integrations with external tools, administrator oversight of active API keys has become vital to rapid incident response.

Previously, Backlog API keys were tied exclusively to individual user accounts, leaving administrators without visibility into who had issued keys or how many were in circulation. This lack of transparency raised the risk of dormant keys being left active and hindered quick investigation or revocation during suspected breaches.

With this update, administrators can conduct security audits, take inventory of active credentials, and take immediate action directly from Backlog—empowering teams to address risks decisively without disrupting unknown workflows.

Key Benefits

• API Key Auditing: Monitor personal API keys across your space, including key owners, creation timestamps, and last used dates.
• Instant Revocation: Administrators can quickly disable unneeded or suspicious API keys.
• Reduced Risk of Exposure: By displaying the full API key only once at generation and masking it thereafter, sensitive credentials are safe from inadvertent exposure during screen shares or screenshots.

How It Works

Once released, administrators and users can navigate the features as outlined below.

For Administrators

1. Navigate to Space Settings > Personal API Keys.
2. Review the list of keys, checking the owner and last activity to identify unused or suspicious credentials.
3. Select and disable the target personal API key.

The list view allows sorting by key owner, created date, and last used date. You can also filter by user, status, and activity.

When an API key is disabled:

• All requests using the key are rejected immediately.
• Its status appears as Disabled in the list.
• The revocation event is logged in Nulab Pass audit logs.

For API Key Owners

If an administrator disables your personal API key, a notification will appear on your “API Settings” page under “Personal Settings.” Only the original key owner can permanently delete a disabled key.

Important Notes

For All Users

• Existing API keys will continue to work after the release.
• Once the update is live, full key strings will no longer be viewable or copyable, including those generated prior to the release. If you need the complete key, please copy and securely store it before the release date, or issue a new key afterward.
• Notes attached to personal API keys will become visible to space administrators (including notes added before this update).
• Keys disabled by an administrator cannot be re-enabled.

For Administrators

• Administrators can disable personal API keys, but cannot delete them.
• Disabling a key will immediately interrupt any active integration relying on it. We strongly recommend reviewing the attached notes and last used dates, or contacting the key owner directly, before revoking access.
• We recommend encouraging team members to add descriptive notes when generating keys to clarify their intended use.

Closing Remarks

We look forward to rolling out these controls on Tuesday, November 24, 2026, to help your organization manage integrations safely and securely.

The Backlog Development Team remains committed to delivering a seamless, enjoyable collaboration experience. If you have any questions or feedback, please reach out via our contact form.

Happy Backlogging!