API keys

Create, manage, and revoke keys for the API.

API keys let scripts and integrations talk to your organisation's data through the API. Keys are scoped: each one carries its own permissions and (optionally) an expiry date. The developer documentation (endpoint reference, request format, scopes) appears in the docs sidebar for users holding the Developer permission.

Creating a key

Open Dashboard → Developer.
Click New key (top-right).
Fill in:
- Key name, a label for you, e.g. "Zapier, leads sync". 1–100 characters, required.
- Permissions, tick the boxes for what the key can do: one row per resource (leads, tasks, invoices, ...) with read / create / update / delete toggles. Default: all unticked.
- Expiry, optional. If set, the key stops working after that date.
Click Create key.

A modal appears showing the raw key, masked by default. Click the eye icon to reveal, then Copy it.

You only see the raw key once

We never store the plaintext, only a SHA-256 hash. If you lose the key, you can't recover it, you'll need to make a new one. Save it in your password manager or your CI's secret store before closing the dialog.

Using a key

Send it as a Bearer token in the Authorization header:

Authorization: Bearer sk_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The first 14 characters (sk_xxxxxxxx_...) are your key prefix, you'll see this on the keys list, in the audit log, and in error messages. The prefix alone can't be used to authenticate.

Editing a key

Click the row in the keys list. You can change:

Name, relabel the key any time.
Permissions, tick / untick boxes.

You can't change the expiry once a key is created.

Revoking a key

Two options:

Revoke, marks the key inactive. Requests with it will get a 401. The key stays in the list for audit purposes.
Delete, permanently removes the key. Once deleted there's no history of it ever existing (apart from audit log entries).

Revoke first when in doubt, it's reversible (we can re-activate). Delete only when you're sure.

Temp keys from the docs playground

When you click Generate test token on an API endpoint page in the docs, the system creates a 1-hour key on your behalf, named "Docs playground (temp: <resource>)". These show up in the same keys list, scoped to full CRUD on just that endpoint's resource, and auto-expire. Revoke them early if you're worried.

Permissions you'll need

You need the Developer permission, and the workspace must be on the plan tier that includes the Custom API (partner orgs can additionally create partner-scoped keys on any tier).