Personal API keys live under Account settings > API keys in the Neon Console. Organization and project-scoped keys live under your organization's Settings > API keys. Each page lists your existing keys with their name, ID, and creation details, but the Console shows the secret token only once, right after you create the key. Save it in a secret manager at that point.

Generate a key

Any user can create a personal key. It can access every project you're a member of across your organizations, and it loses access to an organization's projects if you leave that organization.

  1. In the Neon Console, open the user menu and click Account settings.
  2. Select API keys.
  3. Click Create new API key, give it a descriptive name, then click Create.
  4. Copy the token immediately. You won't be able to view it again.

See Create a personal API key.

Send the key as Authorization: Bearer $NEON_API_KEY on Neon API calls. With the Neon CLI, pass it with the global --api-key option or set the NEON_API_KEY environment variable. Either one skips neon login, which opens a browser to authenticate. See neon login.

List or revoke existing keys

  • Personal keys: Account settings > API keys, then click Revoke next to the key.
  • Organization and project-scoped keys: your organization's Settings > API keys. Organization admins can revoke them.

Revocation is immediate and permanent, and any request that uses a revoked key fails with 401 Unauthorized. Neon API keys don't expire, so you rotate them by hand: create a new key with the same scope, switch your callers over, then revoke the old key. If a key was exposed, revoke it first. See Rotate an API key.

The token is shown once

Neon displays the secret token one time, right after you click Create. The Console lists the key's name and ID afterward, but you can't view the token again. If you didn't save it, revoke the key and create a new one.

There are no client-safe Neon keys

Every Neon API key is a secret that can manage projects, branches, and roles. There's no "publishable" key type, so never ship a Neon API key in a browser bundle or mobile app. For client-side access, use the Data API, which validates user JWTs from Managed Better Auth or another provider and enforces Row-Level Security.

API keys reference

Full guide to creating, listing, and revoking keys via the Console and the API.

Read the docs