Providers / Netlify
Hosting
Netlify API keys and credentials
What every Netlify credential a founder holds does, whether it expires, and what tends to break. Each fact links to Netlify's own docs.
Our research on Netlify is still thin. Treat this page as a starting point and check the linked docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| Personal access token | Must expire | Full access only |
| Build hook URL | Not documented | Full access only |
| Netlify account login | Not documented | – |
Each credential
Personal access token
- Must expire
- Full access only
Creation requires selecting an Expiration date (Applications > Personal access tokens > New access token). Available durations and the default were not documented, and the docs do not say whether a token can be set to never expire. The only access option is 'Allow access to my SAML-based Netlify team'; tokens are denied SAML team data by default. Token value is shown once. Resetting the Netlify password invalidates all personal access tokens created before the reset. Manual revocation steps were not confirmed from official docs.
Build hook URL
- Not documented
- Full access only
Created under Project configuration > Developer settings > Continuous deployment > Build hooks. The URL itself is the credential: a plain HTTP POST to it triggers a build (optional trigger_branch, clear_cache). Netlify does not document it as a secret, but treat it as one.
Netlify account login
- Not documented
Dashboard sign-in. Not an API credential. Session and SSO policy not researched.
What usually goes wrong
- Personal access token used by CI reaches its expiration date and deploys start failing without warning
- Password reset invalidates every personal access token, which breaks CI and scripts that depend on them
- Build hook URL committed to a public repo, letting anyone trigger builds
Renewals and billing
- Netlify plan. Plan and billing cadence not researched.
Not researched.
Where to find it in Netlify
What Netlify's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Expiration durations offered for personal access tokens and their default
- Whether personal access tokens can be set to never expire
- Whether personal access token expiry is readable via API
- Build hook regeneration and deletion steps
- Netlify Identity JWT lifetime (not a founder-created credential here)
- Account login session and SSO policy
- Billing model, usage API, and plan cadence
Rotating or replacing a Netlify key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api
- docs.netlify.com/build/configure-builds/build-hooks/
- open-api.netlify.com/swagger.json
- docs.netlify.com/environment-variables/get-started/
- docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/
- docs.netlify.com/manage/accounts-and-billing/team-management/team-audit-log
Related providers
Keep track of every Netlify key
StackHangar stores your Netlify keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.