X-API-Key header.
Who a key acts as
A key belongs to one workspace and to the person who created it. Every call:- runs as the key’s creator,
- with that user’s role in the workspace (checked on every call, so changing their role changes what the key can do),
- in the key’s workspace.
Managing keys
- Workspace admins create and revoke keys in the app under the workspace’s API keys settings, or with the API keys endpoints.
- The key is shown once when it’s created. Only a hash is stored, so a lost key can’t be recovered; revoke it and create a new one.
- Revoking a key takes effect on the next request.
Keep your key safe
- Call the API from your server or workflow tool, never from a browser.
- Store the key in an environment variable or a secrets manager.
- A key can send email from your mailboxes. Treat it like a password.