Skip to main content

API Keys

This guide explains how to find, regenerate, and use API keys for programmatic access to Sauce Labs Mobile App Distribution.

Overview​

An API key is a unique identifier used to authenticate API requests to Sauce Labs Mobile App Distribution. Your API key is not your account password - it's a separate credential specifically for API access.

API keys are used with:

Finding Your API Key​

To find your API key:

  1. Log in to your Sauce Labs Mobile App Distribution account.
  2. Navigate to Account > Settings.
  3. Locate the Access Key section.
  4. Copy your username and API key.
Sauce Labs Mobile App Distribution Access Key page

Regenerating Your API Key​

To regenerate your API key:

  1. Navigate to Account > Settings.
  2. Click Regenerate in the Access Key section.
warning

When you regenerate your API key, the old key is immediately invalidated. Update all integrations with the new key before they fail.

Using API Keys​

REST API (HTTP Basic Auth)​

The REST API uses HTTP Basic Authentication with your email address and API key:

curl -u "email:api-key" "https://mobile.saucelabs.com/api/1/projects/"

Where:

  • Username: Your email address
  • Password: Your API key (not your account password)

Upload API (Form Parameter)​

The Upload API uses the API key as a form parameter:

curl https://app.testfairy.com/api/upload -F api_key='your_api_key' -F file=@app.apk

Security Best Practices​

PracticeDescription
Keep API keys privateNever share your API key or post it on public code repositories or forums.
Use environment variablesStore API keys in environment variables or secrets management solutions, not in code.
Use service accounts for automationCreate dedicated service accounts for CI/CD pipelines instead of using personal credentials.
Rotate keys periodicallyRegenerate API keys on a regular schedule or after any potential exposure.
Use different keys per environmentCreate separate service accounts for development, staging, and production.
Monitor API usageReview audit logs regularly to detect unusual activity.
Limit key exposureOnly share API keys with systems that need them.

See Also​