Skip to main content
Probo
Get compliant

Products

Compliance Officer Service Expert-led compliance, end to end Compliance Portal Share security documents securely Document Management Draft, approve, and sign your policies Employee Portal Your whole team’s compliance, in one portal Access Review Monitor user access across all your systems AI Agents Run compliance from the tools you use Cookie Banner Consent that follows every visitor's law Device Agent Continuous security posture for every device Open-source platform Deploy Probo on your own infrastructure

Resources

Probo stories How teams get compliant with Probo Blog Ideas and guidance from the Probo team Guides & tools Practical compliance guides and free tools Love from Customers What customers say about working with Probo Changelog Latest product updates Download Get the Device Agent

Company

About The people and vision powering Probo Careers Join the team building Probo Brand assets Official logos and visual resources Security Review our security and compliance posture
Overview Understand Probo and its core concepts Product Explore Probo's GRC capabilities Developers Explore GraphQL, CLI, MCP, n8n, and webhooks Deployment Probo Cloud, self-hosting, and configuration

Explore

GitHub Explore our open-source compliance tools
Changelog
IAM

Personal API keys retired

Personal API keys and their creation UI are gone. Use scoped OAuth access tokens instead, which limit exactly what a token can do rather than acting with a user's full permissions.

Personal API keys retired screenshot

Personal API keys granted whatever access the creating user had, with no way to narrow that down. If a key leaked, so did everything that user could touch. Probo has removed the personal API key creation UI and its GraphQL mutation for that reason.

Scoped OAuth access tokens are the replacement. They only carry the specific permissions you grant at creation, so a token built for reading documents can’t also delete users. Existing personal API keys keep working for now, but new integrations should use OAuth tokens going forward.

It’s a smaller surface to worry about if something goes wrong, and it matches how most API providers handle this today.