API keys
Create keys for programmatic access, and handle them without creating a security incident.
On this page
Creating a key
Settings → API keys → Create key. Name it after where it will be used (zapier-sync, internal-dashboard), not after the person creating it — you need to know what breaks when you revoke it.
The key is shown once. Copy it immediately into your secret store.
An API key is not the widget key
These are completely different credentials and confusing them is the most damaging mistake in this area.
| Widget public key | API key | |
|---|---|---|
| Visible in page source | Yes, by design | Never |
| Can read your tickets | No | Yes |
| Can change settings | No | Yes |
| Safe in front-end code | Yes | No |
An API key acts as your workspace. It must only ever live in server-side code or a secrets manager.
Handling keys
Never commit one to a repository. Even a private one — repositories get forked, cloned, and made public by accident. Use environment variables.
Never paste one into a support ticket, chat, or screenshot. Support will never ask for it.
One key per integration. Then revoking a compromised key breaks one thing rather than everything.
Rotate periodically, and immediately whenever someone with access leaves.
If a key leaks
Revoke it first, investigate second. A revoked key is inert; a key you are still investigating is still working for whoever has it.
- Settings → API keys → Revoke
- Create a replacement and deploy it
- Review recent activity for anything unexpected
- If it was committed to git, rotate it even after removing the commit — history is recoverable and scrapers are fast
Rate limits
API requests are rate limited per key. Exceeding the limit returns an error rather than silently dropping requests. Back off and retry rather than retrying immediately in a tight loop, which will keep you limited.
Scope
A key inherits full workspace access. There is no per-key permission scoping today, which is exactly why key hygiene — one per integration, rotated, never in front-end code — matters.