Access your API Key

Access, copy, revoke, and regenerate the API Key for your Workspace.

Before you begin

• Sign in with an admin user account.
• Open Preferences > API in the platform.

An API Key is a secure alphanumeric identifier that authenticates requests to the platform APIs. Each key belongs to one Workspace and authorizes actions such as sending messages, retrieving analytics and reports, and configuring broadcasts and automations.

View and copy your API Key

1. In Preferences > API, find the Current API Key field. The key is masked by default.
2. Select Show in the lower-right corner of the field to reveal the key.
3. Select the copy icon at the end of the field to copy the key to your clipboard.

Review API Key details

The API tab shows the following details:

A key can have one of these statuses:

• Active: The key is valid and ready for API calls.
• Expired: The key has reached its expiration date and is no longer valid.
• Revoked: An admin manually disabled the key, and it is no longer valid.

Manage your API Key

Revoke an API Key

Revoke a key when you suspect it has been exposed or when you need to replace it. Revocation permanently disables the current key; you cannot reactivate it.

1. Select Revoke API Key.
2. Review the confirmation dialog, then select Confirm.

After confirmation, the platform emails the admin to confirm the revocation.

The key status changes to Revoked, and the Generate API Key button becomes available.

Generate a new API Key

Generate a new key after the previous key expires or is revoked.

1. Select Generate API Key.
2. Choose when the new key expires:
   • Never: The key remains valid indefinitely.
   • After: The key expires after a specified number of days, weeks, months, or years.
   • Custom: The key expires on a specific date that you select.
3. Select Confirm.

The platform emails the admin to confirm that the new API Key is linked to the Workspace.

API Key expiration notifications

The platform sends email notifications to help you rotate credentials before access is interrupted:

• Upcoming expiration reminder: A few days before the key expires, the admin receives an email with the key's expiration date and time and the associated Workspace.
• API Key expired: When the expiration date is reached, the admin receives an email confirming that the key has expired.

All Workspace users with admin-level permissions receive these notifications, regardless of who created or managed the key.

Optional: Follow API Key security practices

API Keys provide access to every endpoint. Protect them in both development and production to reduce the risk of unauthorized access, data breaches, and service interruptions.

Do not hardcode keys

Do not place an API Key directly in source code:

// Do not commit credentials to source control.
const API_KEY = "xxxxxxxxxxxxxx";

Hardcoded keys can be exposed through shared or public repositories, logs, stack traces, and client-side bundles. They are also harder to rotate during an incident.

Store keys in environment variables

Store the key outside your codebase in an environment file, and exclude that file from version control.

1. Add the key to a .env file:

   Bash

   # .env
   THIS_API_KEY=xxxxxxxxxxxxxx

2. Load the value from the environment in your application:

   JavaScript

   require("dotenv").config();
   
   const apiKey = process.env.THIS_API_KEY;
   
   if (!apiKey) {
     throw new Error("THIS_API_KEY is not configured");
   }

Prepare for emergency rotation

Rotate your key if you detect suspicious activity, accidentally expose the key, or reach a scheduled expiration date.

• Keep the key in a centralized configuration location so you can replace it without changing application code.
• Add your environment file to .gitignore so it is not committed.
• Revoke an exposed key immediately, generate a replacement, and update your application's configuration.