Where keys live
API keys are managed under Settings → Integrations, in the API Keys panel. API access requires a paid plan. On the Free plan the panel shows an Upgrade plan link instead.Create a key
Click Create key and fill in the dialog.
The full key is shown once, immediately after creation. Copy it before you close the dialog. After that, the dashboard shows only the key prefix.
Key scope
Permission scopes
Each key holds one or more permission scopes. A request outside the key’s scopes returns403.
Campaign keys are created on the campaign page, not in this dialog. They appear in this same key list, scoped to their campaign. A campaign endpoint accepts only the key bound to that campaign, so an organization or agent key holding Campaigns cannot call one. See Webhook campaigns API.
What the key list shows
Each key row displays its label, key prefix, scope, permission badges, Created date, and Last used date. Last used shows “Never” until the first authenticated call.Revoke a key
Click Revoke on a key row and confirm. Revocation takes effect immediately. Any integration using the key fails on its next request. Revocation cannot be undone.Authenticate requests
Every API request sends the key as a Bearer token.Base URL
Every request goes to the base URL for your organization’s region. Your data stays in that region, so a key issued in one region does not work in another. Pick the row that matches your organization.| Region | Base URL |
|---|
The OpenAPI spec
Each region serves its own machine-readable spec at/api/openapi.json, and the endpoint needs no key. Import that URL into Postman, Insomnia, or a client generator to pick up every endpoint, schema, and error shape. The playground on each API page runs against the same definition.
GET /api/health also needs no key. It returns { "status": "ok" } with a timestamp, which makes it a quick reachability check from your network.
Rate limits
The trigger and channel send endpoints return429 with a Retry-After: 60 header when a request is over the limit. Wait 60 seconds, then retry. Webhook campaign endpoints apply their own per-organization and per-key limits.