API keys
Mint a key, scope it, and rotate it when you should.
Programmatic access uses a workspace API key.
Steps
- Open API key settings and create a key.
- Name it after the system that will use it — "Zapier", "billing sync". A key named "key2" is a key nobody can safely revoke later.
- Copy it now. It is shown once.
- Store it in your system's secret store, never in source control.
You're done when an authenticated request returns your data.
Scope and rate
Keys carry scopes and a rate limit. Give each integration its own key with only the scopes it needs — that way revoking one does not break the others, and a leaked key has a bounded blast radius.
Rotating
Revoke and reissue whenever a key may have been exposed, or when someone who had access leaves. Revocation takes effect immediately.
Gotchas
- A key is workspace-scoped. It reaches that workspace's data and no other.
- Never send a key in a support ticket. Anything shared has to be treated as compromised.