The API Management Dashboard, available from TestRail 10.8 onwards, provides administrators with a centralized way to monitor and manage API access across their TestRail instance.
As teams increasingly rely on integrations and automation, maintaining visibility over API credentials becomes essential. The dashboard brings together both traditional API keys and OAuth 2.0 tokens, allowing administrators to:
- Monitor API access: View active credentials, who created them, when they were last used, and how many API calls they've made.
- Revoke access centrally: Disable API keys and OAuth 2.0 tokens that are no longer needed or should no longer have access.
- Simplify access management: Manage API credentials across the instance without relying on individual users to revoke their own credentials.
The dashboard supports both API keys and OAuth 2.0 tokens, allowing organizations to benefit from centralized API management regardless of their authentication method.
Managing access tokens — administrators
Viewing all tokens
Go to Site Settings > API > Access Management.
The dashboard lists all active OAuth 2.0 tokens and API keys across your instance:
| Column | Description |
|---|---|
| Name | Token or key name |
| Type | OAuth 2.0 or API Key |
| Created by | The user who authorized or generated the token |
| Last used | Date and time of the most recent API call |
| API Calls | Total number of API calls made |
Revoking a token
- In the Access Management dashboard, find the token you want to revoke.
- Click Revoke.
- Confirm in the dialog that appears.
Managing your own tokens — users
Viewing your tokens
Go to My Settings > API Keys.
All your active API keys and OAuth 2.0 tokens are listed here. If an administrator has revoked one of your tokens, a notification appears at the top of the list.
Generating an API key
- Go to My Settings > API Keys.
- Click Add API Key.
- Enter a name for the key and click Generate.
- Copy the key immediately — it is shown only once.
Revoking your own token or key
- Go to My Settings > API Keys.
- Click Revoke next to the token or key and confirm.
Note: Revoking a token or key immediately disables access for any tool using it.
API Access Permissions
The ability to generate API credentials is controlled through role-based permissions. Administrators can configure which users are allowed to generate API keys and authorize integrations.
For more information, see Managing user permissions and roles.