API keys

1. Create a key#

1. Open the screen

   Go to Settings → General settings → API keys.

2. Create the key from a correctly scoped account

   A key carries the permissions of the account that created it. Create it from an account scoped to exactly what the integration needs — see Roles.

3. Copy it immediately

   It is shown once.

4. Store it as a secret

   On the calling side, in a secret store or environment variable.

A key is shown once, when it is created. If it is lost, revoke it and issue a new one rather than trying to recover it.

2. Handling keys safely#

• One key per integration, so you can revoke one without breaking the rest.
• Never put a key in a front-end bundle, a spreadsheet or a shared document.
• Rotate immediately if it appears anywhere shared, including a support thread.
• Revoke keys belonging to integrations you have stopped using, and keys created by people who have left.

3. What the API is for#

Reading your own portfolio data into reporting, accounting or internal tools.

It is not a way to give a third party broad access. Scope the creating account rather than sharing a powerful key.