Your API key identifies your organization to anything acting on its behalf. It lives on Settings → Integrations → API Key, and only owners can manage it.
Generating one
Generate the key from that panel. It's shown once — copy it straight into wherever it's going, because it can't be displayed again afterwards.
Lost it? Generate a new one. That invalidates the old key immediately, so update anything using it in the same sitting.
Keeping it safe
- Treat it like a password. It speaks for your whole organization.
- Store it in your automation tool's secret store, not in a spreadsheet or a shared doc.
- Never put it in client-side code, a URL, or anything that ends up in a browser.
- Rotate it when someone with access to it leaves.
Careful
Rotating breaks every integration using the old key at once. Have the list of what needs updating in front of you before you click, not after.
Key or webhook?
They point in opposite directions, and most people only need the second one.
| Direction | Good for | |
|---|---|---|
| API key | Your system asks us | Pulling data on your own schedule |
| Webhook | We tell your system | Reacting the moment something changes |
If the question is "how do I get told when a contractor lapses?", the answer is a webhook, not the key.