Manage API Keys

Most actions performed in the Neon Console can also be performed using the Neon API. You'll need an API key to validate your requests. Each key is a randomly-generated 64-bit token that you must include when calling Neon API methods. All keys remain valid until deliberately revoked.

Types of API keys

Neon supports three types of API keys:

While there is no strict limit on the number of API keys you can create, we recommend keeping it under 10,000 per Neon account.

Creating API keys

You create and manage API keys in the Neon Console, and where you go depends on the key type:

• Personal keys: open the user menu and select Account settings > API keys.
• Organization and project-scoped keys: switch to your organization, then go to Settings > API keys.

Each page lists your existing keys with their name, ID, and creation details, plus a button to create a new key. You'll need to create your first API key from the Console, where you are already authenticated. You can then use that key to generate new keys from the API.

When creating API keys from the Neon Console, the secret token will be displayed only once. Copy it immediately and store it securely in a credential manager (like AWS Key Management Service or Azure Key Vault); you won't be able to retrieve it later. If you lose an API key, you'll need to revoke it and create a new one.

Create a personal API key

You can create a personal API key in the Neon Console or using the Neon API.

Create an organization API key

Organization API keys provide admin-level access to all organization resources. Only organization admins can create these keys. To create an organization API key, you must use your personal API key and be an administrator in the organization. Neon will verify your admin status before allowing the key creation.

For more detail about organization-related methods, see Organization API Keys.

Create project-scoped organization API keys

Project-scoped API keys have member-level access, meaning they cannot delete the project they are associated with. These keys:

• Can only access and manage the specified project
• Cannot perform organization-related actions or create new projects
• Will stop working if the project is transferred out of the organization

Make an API call

The following example demonstrates how to use your API key to retrieve projects:

curl 'https://console.neon.tech/api/v2/projects' \
  -H 'Accept: application/json' \
  -H "Authorization: Bearer $NEON_API_KEY" | jq

where:

• "https://console.neon.tech/api/v2/projects" is the resource URL, which includes the base URL for the Neon API and the /projects endpoint.
• The "Accept: application/json" in the header specifies the accepted response type.
• The Authorization: Bearer $NEON_API_KEY entry in the header specifies your API key. Replace $NEON_API_KEY with an actual 64-bit API key. A request without this header, or containing an invalid or revoked API key, fails and returns a 401 Unauthorized HTTP status code.
• jq is an optional third-party tool that formats the JSON response, making it easier to read.

{
  "projects": [
    {
      "cpu_used_sec": 0,
      "id": "purple-shape-411361",
      "platform_id": "aws",
      "region_id": "aws-us-east-2",
      "name": "purple-shape-411361",
      "provisioner": "k8s-pod",
      "pg_version": 15,
      "locked": false,
      "created_at": "2023-01-03T18:22:56Z",
      "updated_at": "2023-01-03T18:22:56Z",
      "proxy_host": "us-east-2.aws.neon.tech",
      "branch_logical_size_limit": 3072
    }
  ]
}

Refer to the Neon API reference for other supported Neon API methods.

List API keys

Revoke API Keys

You should revoke API keys that are no longer needed or if you suspect a key may have been compromised. Key details:

• The action is immediate and permanent
• All API requests using the revoked key will fail with a 401 Unauthorized error
• The key cannot be reactivated; you'll need to create a new key if access is needed again

Who can revoke keys

• Personal API keys can only be revoked by the account owner
• Organization API keys can be revoked by organization admins
• Project-scoped keys can be revoked by organization admins

Rotate an API key

Neon API keys don't expire or rotate on a schedule, so you rotate one manually. Because revocation is immediate, create the replacement first to avoid downtime:

1. Create a new key with the same scope as the old one (see Creating API keys).
2. Update every caller that uses the old key, such as CI secrets, Terraform variables, serverless functions, the Neon CLI, and any MCP server configuration.
3. Revoke the old key once nothing depends on it.

If you're rotating because a key was exposed, revoke the compromised key first, then create and roll out its replacement. For rotating Postgres passwords alongside API keys, see Reset a password.

To view the API documentation for this method, refer to the Neon API reference.