API keys and the API

An API key is a password that belongs to a program instead of a person. Treat it the same way: issue one per system, and revoke it when that system goes away.

Step by step

1. Open API → API management and create a key.
2. Give it a name that says which system uses it — future-you will need to know which one to revoke.
3. Copy the key once. It is not shown again; if you lose it, issue a new one.
4. Store it in the calling system's configuration, never in code you share or in a document.
5. Read API → API guide for the endpoints and the request shapes.
6. Revoke the key the day the system that used it is decommissioned.

The other interfaces

• Customer API in the sidebar is the customer-facing interface, with its own settings page.
• Automation / workflows → GraphQL → Token issues a GraphQL token and links the documentation.
• Automation / workflows → Webhooks pushes events out instead of being polled — see Webhooks and connecting other systems.
• AI Studio → Personal API keys is a separate set, for the AI Studio side.

Keeping it safe

1. One key per system, never a shared one.
2. Give a key only the access the system needs.
3. Rotate keys on a schedule, and immediately when somebody who knew one leaves.
4. Watch Central → Audit log for what a key did.