Create and manage API keys

1. 1Open API Keys — Manage API keys for external integrations
2. 2Create API Key.
3. 3Give it a Name — e.g. Production, Staging, Website Integration — and a Description (optional): What this key is used for
4. 4Tick the Permissions it needs.
5. 5Create, then copy the key: Copy this key now. It will not be shown again.

⟦Store this key securely. You will not be able to see it again.⟧ Put it straight into your password manager or your deployment secrets. If it is lost, there is no recovery — you rotate the key and update the integration.

One key per integration, never one shared key. Separate keys mean you can revoke the website's access without breaking the accounting sync, and Last used {{date}} tells you which keys are actually in use — which is how you find the one from a project that ended two years ago.

Scopes are read, write and delete per record type — Leads — Read is List and view leads, Leads — Write is Create and update leads, and so on.

Grant the minimum. An integration that only pushes web-form leads needs write on leads and nothing else; giving it delete on customers costs you nothing today and everything on the day it has a bug. Not on your plan — Upgrade your plan to grant these permissions.

Changing permissions later. Edit permissions — Tick the permissions this key should have. Changes take effect immediately. The key itself does not change, so nothing needs reconnecting.

⟦Rotate key⟧ issues a new secret for the same integration. Do it on a schedule, and immediately if a key has ever been pasted into a chat, a ticket or a commit.

⟦Revoke Key⟧ — This will immediately invalidate the key. Any applications using it will stop working. This action cannot be undone. Revoked keys stay listed under Revoked Keys as a record.

Keys from connected apps. This key was created when someone connected an external app, and its permissions are the ones they approved at the time. Changing them here changes what that app can do, without asking them again.