An API Key is a secure, alphanumeric identifier that enables authentication and access to the platform's APIs. It works as an access token that validates the identity of the requester and authorizes specific actions based on that identity.

Only admin users can access their API Key. It is located in the Preferences section of the platform, under the API tab.

The API tab displays the following information about your API Key:

• Current API Key: This field contains your active API Key, which is masked by default for security.

  Click the Show button in the lower right to reveal the key. You use the copy icon at the end of the field to copy the key to your clipboard.

  🚧

  warning

  This API Key should be kept secure and never shared or exposed in public code.

• Creation Date: Displays the date and time when the current API Key was generated.

  This helps you track when the key was issued for expiration policies or auditing access.

• Status: Displays the current state of the API Key. The possible statuses are:

  • Active: The key is valid and ready to use in API calls.
    
  • Expired: The key has reached its expiration date and is no longer valid.
    
  • Revoked: The key has been manually disabled and is no longer valid.

• Expiration Date: Indicates the date and time when the API Key will become invalid.

  This field is critical for planning key rotation. Once this date is reached, the key will automatically be marked as Expired.

• Action Buttons: Two key action buttons appear at the bottom right of the panel:

  1. Revoke API Key: This button immediately disables the current API Key. Clicking this opens a confirmation dialog. Once confirmed, the key is revoked permanently and cannot be reactivated.

     

     After you click Confirm, the platform sends the admin a notification email confirming the API Key revocation.

     

     The Generate API Key button becomes available. The API Key status changes to "Revoked".

     

  2. Generate API Key: This button creates a new API Key after the previous one is revoked or expired. Clicking this opens a configuration dialog that lets the admin define when the new API Key will expire.

     

     The available options for generating a new API Key include:

     • Never: The key will remain valid indefinitely.\
       
     • After: Expires automatically after a defined number of days, weeks, months, or years.\
       
     • Custom: The admin selects a specific expiration date from a calendar picker.

     After you click Confirm, the platform sends the admin a notification email confirming the new API Key is linked to the Workspace.

     

API Key Expiration Notifications

The platform automatically sends email notifications related to API Key expiration. This ensures your team has enough time to rotate credentials before access is interrupted.

The platform sends the following notifications:

• Upcoming Expiration Reminder: A few days before the API Key expires, the admin will receive an email reminder.

  This email includes:

  • The expiration date and time of the API Key.
  • The Workspace to which the key belongs.

• API Key Expired: Once the expiration date is reached, the admin receives a second email confirming the API Key has expired. This helps prevent unexpected service disruptions by alerting the team in real-time.

All users with admin-level permissions in the Workspace receive the API Key notifications. This applies regardless of who created or managed the key.

API Key Best Practices

API Keys provide access to every endpoint. Strict security protocols apply in development and production. Mismanagement of API Keys can expose your system to unauthorized access, data breaches, and service interruptions.

Avoid Hardcoding API Keys

Never hardcode your API Key directly into your source code.

Example of what not to do:

// ❌ This is insecure and should be avoided
const API_KEY = "xxxxxxxxxxxxxx";

Why is this dangerous?

• If the codebase is stored in a public or shared repository, the key may be exposed to unauthorized users.\
  
• Hardcoded keys are difficult to rotate in case of emergencies.\
  
• They often end up in logs, stack traces, or client-side bundles (especially in web or mobile apps), increasing the risk of accidental leaks.

Recommended Storage: Configuration Files

Secure, environment-based configuration files store API Keys outside the main codebase. This makes your app more flexible and secure.

For example:

1. Store the key in a .env file:
   

   bash

   # .env
   THIS_API_KEY=xxxxxxxxxxxxxx

2. Then load it using a library like dotenv:\
   

   JavaScript

   require('dotenv').config();
   const apiKey = process.env.THIS_API_KEY;

Plan for Emergency Key Rotation

API Keys may need to be rotated at any time due to:

• Suspicious activity
• Accidental exposure
• Scheduled expiration

To respond quickly:

• Keep API Keys in a centralized, editable config file.
• Ensure the file is excluded from version control (.gitignore).
• Structure your application so you can replace the key without code changes or redeployments.