Manage Your APIZ Account

APIZ uses WorkOS AuthKit for human identity and keeps product authorization in APIZ. WorkOS owns passwords, social login, verified email, MFA, connected login methods, and recovery. APIZ owns Teams, Memberships, roles, API resources, billing relationships, sessions issued by APIZ, and Audit evidence.

Register Or Sign In

Select Get started on a public page. AuthKit presents registration and sign-in from the same entry. Contextual Start free actions may open the registration screen directly. The first verified WorkOS login provisions an APIZ User, an initial Team, an Owner Membership, and the Free allocation.

The initial authentication methods are Email + Password, Google, GitHub, and Apple. APIZ never receives a password or social-provider token and does not link identities by matching email addresses.

Manage Profile And Sign-In Security

Open the avatar menu, select Personal settings, and use:

• Profile for WorkOS-owned profile fields;
• Security for password and MFA controls;
• API Keys to manage APIZ credentials for CLI and trusted applications;
• Sessions to review other active WorkOS sessions and revoke one; and
• Notifications for APIZ product notification preferences.

WorkOS renders the Profile and Security controls inside the APIZ-designed settings surface. Available MFA methods depend on the configured WorkOS environment and the current identity. APIZ does not display or store MFA secrets. Revoking the current session is intentionally handled by Logout rather than the Sessions page.

APIZ does not yet require a fresh MFA challenge for an individual sensitive operation. Team ownership, membership, billing, and account closure still enforce APIZ authorization and confirmation rules. A future step-up flow must verify recent WorkOS authentication server-side before it can guard those operations.

Manage User API Keys

Open Personal settings → API Keys, then select Create API Key. Give the key a recognizable name, select an expiration (30 days by default), then select the Teams and permission presets or personal access you need. Review the expanded permissions before creating it. New keys do not include future Team memberships. Copy the value into your application's secret store before closing the result dialog. APIZ shows the full key only once; it cannot be recovered from the list.

A User API Key authenticates Control Plane management requests as you. For Team resources, select a Team you belong to; your current Membership and role still apply. Keep this key in the trusted host application. Use that application to issue Client Access Credentials for agents and sandboxes. A User API Key cannot directly authenticate Data Plane requests.

The list shows a safe credential hint, status, expiration, and last-used time. Last-used updates are best effort, so an absent timestamp is not proof that a key has never been used. Use Refresh for current metadata and Load more for older keys. To rotate, create a replacement, update your application, verify it works, then revoke the old key. Revocation immediately blocks further management requests using that key; it does not sign out your browser.

If creation times out, use Check result to repeat the same operation without minting a duplicate. A committed operation returns the created key ID, but cannot recover its value. Open that key, revoke it, then create a replacement.

Open a key's name to review its stored grants, current availability, personal history and Team activity. Team activity requires your current log permissions; key ownership does not grant additional Team access. Historical keys are marked Legacy unrestricted. Replace them with explicit grants when practical.

For the CLI, inspect apiz api-key permissions, save the authorization object in a JSON file, then run:

apiz api-key create --label orchestrator --expires-at 720h --authorization-file grants.json
apiz api-key get KEY_ID
apiz api-key activity KEY_ID
apiz api-key revoke KEY_ID

Keep the creation operation ID from an uncertain result and retry with --operation-id UUID and the same body. Key management requires a session; a newly scoped key cannot create other keys. Revoking a management key does not revoke already-issued Client Access Credentials.

See Tokens and sessions for the canonical credential boundary and CLI storage rules.

Sign Out

Open the avatar menu and select Logout. APIZ first revokes the server-side session, attempts to revoke its bound WorkOS session, and then clears the browser cookies. A Console URL must require authentication afterward.

If logout fails, APIZ keeps the user in Console and shows a recoverable error; do not treat closing the browser tab as proof of server-side revocation.

Close Your Account

Open Personal settings, then Account. APIZ blocks closure while the User owns an active Team. Transfer each Team to another Owner or complete Team Closure before retrying.

Eligible closure requires the exact displayed confirmation phrase. A successful closure permanently deletes the WorkOS User, disables the APIZ identity, and revokes browser sessions, CLI sessions, User API Keys, and User-issued Client credentials. Team resources, billing records, and required Audit evidence remain under their existing Team scope.

Account Closure is not a substitute for Team Closure. If the provider request fails, APIZ restores the active User rather than claiming that closure succeeded. If provider deletion succeeds but local finalization is interrupted, the identity remains fail closed while an operator completes audited recovery.