How do I create and manage API keys?

API keys are managed by organization admins from the API Keys tab on your profile page in the console.

• Sandbox and production each have their own keys. Sandbox keys start with sand_ and only work against sandbox, where nothing is billed and no real data is touched. Production keys start with prod_.

• You can view and copy your keys from the console at any time, so you do not need to capture them at creation. Do store them in a secrets manager rather than in code or config files.

• Create one key per integration or service so you can revoke one without affecting the others. Deleting a key revokes it immediately.

• Key creation and deletion emit APIKey.created and APIKey.deleted webhooks if you want to track them.

Send the key in the X-API-Key header on every request, for example X-API-Key: sand_your_key_here. Do not send it as a bearer token in the Authorization header, as requests authenticated that way will fail. If a key is exposed, delete it in the console and create a replacement; there is no need to contact us.