Skip to main content
Workspace API tokens let Enterprise SSO workspace admins use one token across every organization in the workspace for supported public APIs.

​
Availability

Workspace API tokens are available only in Enterprise SSO workspaces. Open Workspace Settings > API Tokens or go to /workspace/api-keys in the CodeRabbit app. Only workspace admins can create, list, or delete workspace API tokens. Non-admin workspace members cannot manage tokens, and CodeRabbit re-checks workspace admin access every time a workspace token is used.

​
Create a token

1

Open Workspace API Tokens

In the CodeRabbit app, open Workspace Settings > API Tokens.
2

Create the token

Choose Create API token, enter a name, and select an expiration date.
3

Copy the token

Copy the token value immediately. CodeRabbit shows the token only once.
Use the token with the x-coderabbitai-api-key header:

​
Supported APIs

Workspace API tokens are supported on these public APIs:

​
Organization scoping with org_id

org_id is the Git provider organization ID for an organization inside the token’s workspace. It controls which organization a workspace token targets:
  • Endpoints that require org_id (POST /v1/users/roles and the /v1/roles operations) act on the single organization you name. CodeRabbit returns 400 when a required org_id is omitted, 404 when the ID does not match an active organization in the workspace, and 403 when the token owner is no longer a workspace admin.
  • Endpoints that omit org_id (users, seats, audit logs, review metrics, and learnings) operate workspace-wide across every organization. Pass org_id on the read endpoints to scope the result to one organization instead.
Other key types treat org_id differently:
  • Organization-scoped API keys remain bound to their authenticated organization and ignore org_id.
  • Self-hosted instance API keys ignore org_id on the workspace-token read and custom-role endpoints above. The one exception is POST /v1/users/roles, which accepts a self-hosted-only "ALL" sentinel—see Assign roles for details.

​
What’s next

Review the API reference

Explore request parameters and response schemas for the supported public APIs

Manage custom roles

Define role permissions for organizations in your Enterprise SSO workspace

Review audit logs

Track administrative activity across the workspace