An API key is a secret credential that lets you call the Platform’s REST API from your own code (a script, a backend, an external CRM…) without going through the login form: instead of email and password, your integration sends the key on every HTTP request. It’s the mechanism meant for M2M integrations (machine-to-machine) — automations, syncs with other systems, your business’s internal scripts — never for a person to log into the Platform’s own interface with it.
What API keys are and what they're forAn API key is a secret credential that lets you call the Platform's REST API from your own code (a script, a backend, an external CRM…) without going through the login form: instea
The two key typesThe Platform distinguishes two key types by their owner.
PrerequisitesYour agency's active subscription (a key on an account blocked for billing can't be used — the same
Procedure: create a personal keyRequirements: none in particular — any role can create keys for themselves.
Procedure: create a company keyRequirements: Admin role.
Allowed originsEvery key has an optional list of allowed origins: the domains (hostnames) it's accepted from when the request arrives with an Origin header (that is, from a browser).
What each key can do: permissions and the "Customize" pickerNo key carries "à la carte" permissions by default: it inherits an already-defined set of permissions, sealed the moment it's created (section 2).
ExpirationWhen you create the key you choose how long it lasts: Never, 30, 90 or 365 days.
RevocationThere's no "delete" for a key: only revoke.
Usage: authenticating with X-API-KeyOnce you have the key, authenticate every request by adding the X-API-Key header with the key's full value.
Request limits (rate limit)Besides the general limits already applied to any request (per tenant, per user or per IP, depending on the case), every request that includes the X-API-Key header gets an addition
Common errors and how to fix themCode · When it happens · What to do
Custody best practicesDon't share it over chat, unencrypted email, or paste it anywhere public.
Frequently asked questionsCan I have several personal keys at once?