Skip to main content
Create a key in Settings → API & integrations and send it with each request:
The secret is shown once. Keep it on your server or in the client’s secret storage, outside URLs, source control, analytics, and public client bundles. These permissions apply to the account library. Create and edit permissions alone do not grant read access. Start with only what your integration needs. Keys expire after 90 days by default. You can choose 1–365 days, with up to 50 active keys per account. The limit is 120 requests per minute per key. A 429 response includes Retry-After; wait that many seconds before retrying. Revocation takes effect on subsequent requests.

​
Manage access

Use Settings, or use a signed-in account session with POST /api-keys, GET /api-keys, and DELETE /api-keys/{id}. Creation takes a name, permissions, and optional expiry. Italic assigns the integration identity automatically. The response contains key metadata and a one-time secret. An API key cannot create other keys or manage webhook destinations. These actions require the account owner’s session. Existing keys also work with v2; they do not need to be recreated.