Create a key
- Open Settings, then API keys, and choose Create key.
- Name it after the system that will use it. Choose a scope and an optional expiry.
- Copy the key now and store it in your system's secret store.
Important: The full key is shown once. If you lose it, revoke it and create another.
| Scope | Acts as |
|---|---|
| Read only | A viewer. It can read what a viewer can read. |
| Read and write | A manager at most. It can create and change what a manager can. |
Use it
Send the key in the Authorization header of every request to the app's API:
Authorization: Bearer ehk_...
- A key works only for its own organization and only with its scope.
- No CSRF header is needed with a key.
- A key cannot create or manage other keys.
- Requests made with a key are recorded in the audit log as the API key.
Revoke
Choose Revoke on a key and it stops working immediately, so the systems using it get 401 errors. A key also stops working when the member who created it leaves the organization. The list shows when each key was last used.
Tip: Give each integration its own read-only key where you can. If one leaks, you revoke only that one.
To get the description of the API for your developers, ask through the contact form.