Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Neon · Const

API keys

Neon API keys are bearer tokens for authenticating Neon REST API requests. They come in personal, organization, and project-scoped forms; store the token securely because it is displayed only once.

How it works

An API key is a randomly generated bearer token for Neon REST API requests. Neon provides personal, organization, and project-scoped keys; choose the narrowest scope that supports the caller, store the token securely, and send it in the Authorization header.

Syntax

Authorization: Bearer $NEON_API_KEY

Key points

  • The secret is a randomly generated 64-bit token that must accompany Neon API calls.
  • A personal key reaches projects where its owner is a member across organizations.
  • An organization key applies to every project in its organization.
  • A project-scoped key is restricted to one selected project.

Common mistakes

  • Save the token immediately when it is created; it cannot be viewed again later.
  • Revocation instantly stops callers that still use the key.

Example: Authenticate a Neon API request

const response = await fetch("https://console.neon.tech/api/v2/projects", {
  headers: {
    Authorization: `Bearer ${process.env.NEON_API_KEY}`,
  },
});

if (!response.ok) throw new Error(`Neon API error: ${response.status}`);

const projects = await response.json();
console.log(projects);

Reads the key from an environment variable and sends it as a Bearer token when listing Neon projects.

When to use it

Personal development automation

A developer runs scripts against projects they can access.

Organization automation

A team authenticates CI/CD workflows across an organization.

Limited-scope service integration

An integration should access only one Neon project.

Interview questions

QWhat are Neon API keys used for, and what scopes are available?

Neon API keys authenticate REST API requests as Bearer tokens. Personal keys cover projects the user can access, organization keys cover an organization, and project-scoped keys cover one project.

Follow-up: How would you reduce blast radius? Use a project-scoped key where possible and keep it in a secret store rather than source code or client-side runtime.

QHow should a client authenticate a Neon API request?

Create a key with a descriptive name, copy the returned token immediately, and send it in the Authorization header as Bearer authentication. The token is returned only during creation.

Follow-up: What happens if the token is lost? Create a replacement key, update every caller, then revoke the old key.

QHow do you rotate a Neon API key safely?

A safe rotation creates a replacement with the same scope, updates all consumers such as CI or serverless functions, verifies them, and then revokes the old key. Revocation takes effect immediately.

Follow-up: Why keep the same scope during rotation? It preserves authorization behavior while changing only the secret value; scope can be reduced in a separate change.

  • Neon REST API
  • Bearer authentication
  • Personal API key
  • Organization API key
  • Project-scoped API key
  • NEON_API_KEY
  • Create API key
  • List API keys

Source: Manage API Keys. Checked 2026-10-16.