Skip to main content
API requests are authenticated with a workspace API key, sent as a Bearer token. Keys can only read, from the endpoints listed below. Webhooks, keys and members are managed in the web app while signed in: see Managing webhooks.

​
API keys

  • A key belongs to a workspace, not to a person. It keeps working when the person who created it leaves.
  • Admins and members create and delete keys under Connect → API keys. The value is shown once, at creation; the list shows only its last characters, when it was created and when it was last used.
  • A workspace can hold 20 keys. Create one per system so you can revoke one without touching the others.
  • Deleting a key stops it working within a minute.
  • To rotate a key, create a new one, deploy it, then delete the old one.

​
Sending the key

Send the key in the Authorization header of every request:
HTTP
A missing key is 401 unauthorized; a key that is wrong, deleted or malformed is 401 invalid_api_key. Call the API from your servers: browsers on other origins are refused, and a key in front-end code is readable by anyone.

​
Endpoints that accept a key

Other paths the web app calls may change without notice; build only on the endpoints documented here.

​
Managing webhooks

An API key cannot manage anything, and there is no management API to call with one. Webhooks, API keys, members and workspaces are managed in the web app, signed in as an admin or member of the workspace:
  • Connect → Webhooks: New webhook; and in a webhook’s Settings: Save changes, Send test event, Reveal signing secret, Rotate secret, Resume deliveries, Resume and resend what was not sent and Delete webhook. Deliveries shows the log, with Resend on each delivery.
  • Connect → API keys: Create key, and Delete on each key.
  • Members & invitations: invite people, change roles and remove members (admins only).
Where these docs name a route of the app (for example POST /v1/webhooks/{id}/resume), it is the route that button calls. Those routes belong to the signed-in app: they need a session, are not available to API keys, and may change without notice.