Providers / Render
Hosting
Render API keys and credentials
What every Render credential a founder holds does, whether it expires, and what tends to break. Each fact links to Render's own docs.
At a glance
| Credential | Expiry | Permissions |
|---|---|---|
| API key (classic, all workspaces) | Not documented | Full access only |
| Scoped API key (early access) | Not documented | Can be scoped |
| Deploy hook URL | Not documented | Full access only |
| Render Dashboard login | Not documented | – |
Each credential
API key (classic, all workspaces)
- Not documented
- Full access only
Created in Account Settings > Create API key. Shown in full once. Gives access to all workspaces the user belongs to. Revoking takes effect immediately (trash icon, then confirm), so replace the key in use first. Docs do not state an expiry or rotation policy. Classic keys keep working while scoped keys roll out.
Scoped API key (early access)
- Not documented
- Can be scoped
Early access. Limited to one workspace; create one key per workspace. Permissions are set per resource type (for example Read, Read & write, Run, Execute) or for all resources in a workspace. Permissions can be changed later via the gear icon. Access follows the creator's member role. Docs warn scoped keys may introduce breaking changes. No expiry documented.
Deploy hook URL
- Not documented
- Full access only
Per service, found in service Settings. URL contains a key query parameter that authenticates the request; Render calls it a secret. Use Regenerate Hook if it may be compromised; the old URL then stops working. No expiration documented.
Render Dashboard login
- Not documented
Dashboard sign-in. Not an API credential. Session and SSO policy not researched.
What usually goes wrong
- Classic API key with access to every workspace is pasted into CI, so one leak exposes all workspaces
- Revoking a key before replacing it in CI, which breaks deploys immediately
- Deploy hook URL shared in chat or committed to a repo; anyone with it can trigger deploys until it is regenerated
Renewals and billing
- Render workspace billing (services and databases). Billing is per service and database; cadence not researched.
Not researched.
Where to find it in Render
What Render's docs don't say
We couldn't confirm these from official docs, so don't rely on them either way:
- Whether any Render API key expires (docs describe no expiry or TTL)
- Whether API key expiry is readable via API
- Early access status and GA timing for scoped keys
- Audit log API keys (read-only, org owners) not detailed here
- Dashboard login and SSO policy
- Billing model, usage API, and billing cadence
Rotating or replacing a Render key
The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:
Sources
- render.com/docs/scoped-api-keys
- api-docs.render.com/reference/authentication
- render.com/docs/deploy-hooks
- api-docs.render.com/reference/update-env-vars-for-service
- api-docs.render.com/reference/update-env-var
- api-docs.render.com/reference/create-deploy
- render.com/docs/api
- render.com/docs/audit-logs
Related providers
Keep track of every Render key
StackHangar stores your Render keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.