Managing API Keys

An API key is how something that isn't a person proves it's allowed to talk to your workspace — a webhook, a Zapier connection, a script, an integration you built yourself.

Creating a key

1. Go to Settings > API Keys.
2. Create a new key.
3. Give it a description — name it after the thing that will use it. "Gravity Forms on the main site" beats "key 2" the day you're trying to work out what breaks if you delete it.
4. Choose the access level.
5. Save, then copy the key.

Access levels

• Read-only (recommended) — the key can read data and change nothing. Start here. Most integrations that only pull data need nothing more, and a leaked read-only key is a much better morning than the alternative.
• Custom scopes — pick exactly which permissions the key gets. The right choice for a webhook that needs to create contacts but has no business deleting them.
• Full access — everything. Use sparingly, and only where you genuinely control both ends.

Managing keys

Each key offers Edit access, Regenerate key, and Delete key.

Regenerate issues a new secret and invalidates the old one immediately. Anything using the previous value stops working the moment you regenerate, so have the update ready before you click it. This is the right response to a key you think has leaked.

Delete removes the key entirely, with the same immediate effect on whatever was using it.

Keys belong to the workspace, not to you

This is worth understanding clearly.

An API key is owned by the workspace. The person who created it is recorded, but only as a note of who did it — the key's access doesn't depend on them. When that person leaves the team and has their access removed, the key keeps working.

That's deliberate. It means your integrations don't collapse the week someone changes jobs. But it also means removing a user is not the same as revoking what they set up. When somebody with admin access departs, come to this screen and review the keys.

The related protection: a key can never be given more access than the person creating it has. An admin can mint a full-access key; someone on a limited custom role cannot mint themselves a way around their own limits.