API keys

Who can create keys

API keys are created by team administrators. You must be authenticated and have admin access to your team. Each key is scoped to your team and inherits your team's permissions.

Creating an API key

Navigate to Admin, then Team, then API Keys. Click Create API Key and give it a descriptive name (e.g. "CRM sync" or "Analytics export"). The key is displayed once on creation — copy it immediately.

Using API keys

Include your API key as a Bearer token in the Authorization header of your HTTP requests.

curl -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Accept: application/json" \
     https://your-domain.test/api/v1/organizer/events

Key management

View all your API keys in the API Keys section. Each key shows its name, a preview of the last four characters (for identification), when it was created, and when it was last used. The last-used timestamp helps you identify inactive keys that may be safe to revoke.

Revoking keys

Delete a key when it is no longer needed or if it may have been compromised. Revocation takes effect immediately — all requests using that key will fail with a 401 Unauthorized response. Connected integrations will stop working until they are updated with a new key.

Security best practices

Keep your API keys secure with these guidelines:

• Store keys in environment variables or a secrets manager, never in source code
• Rotate keys periodically — create a new key, update your integration, then revoke the old one
• Use separate keys for different integrations so you can revoke one without affecting others
• Monitor the last-used timestamp to detect unexpected usage
• Never share keys in chat, email, or public channels