Authentication

The Data API authenticates every request with an API key passed in the X-API-Key header. There is no OAuth flow and no session cookie, and the Authorization header is not read. A key identifies the workspace it belongs to and what it is allowed to do.

Creating a key

Keys are created in the dashboard under Settings > Integrations > API keys. Creating and revoking keys requires the Owner or Admin role in the workspace, and a key belongs to the workspace that was active when you created it. Every request made with the key reads and writes that workspace only.

SurfacedBy shows the full key exactly once, when you create it. It cannot be recovered later. Store it in a secret manager and never commit it to source control.

A key is 40 characters: an 8-character prefix (sk_live_ or sk_test_) followed by 32 random letters and digits. The panel lists each key by its first 16 characters (for example sk_live_aBcDeFgH), which are safe to log.

Live versus test keys

• Live keys (sk_live_...) read and change your real workspace data.
• Test keys (sk_test_...) never touch your workspace. Reads return a fixed sample data set, and writes are stored in a sandbox private to that key. The sandbox is discarded 24 hours after the key's last write. List endpoints return the whole sample set in one page, and the domain_id in the path is not checked against your account.

Test keys still require a Professional or Agency plan, and each has its own rate-limit counters. Use a test key while you build an integration, then switch to a live key.

Scopes

• read - every GET endpoint. Every key has it.
• write - the POST and DELETE endpoints. Only Agency workspaces can grant it, by ticking "Grant write scope" when creating the key.

A request to a write endpoint with a key that lacks the write scope returns 403 scope_required. A key from a workspace whose plan has no API access returns 403 tier_required.

Key limits

Each plan caps the number of active keys per workspace, counted separately for live and test keys:

Starter, Trial, and Free workspaces cannot create keys. Revoke a key before creating a replacement if you are at the limit.

Expiry and plan changes

Data API keys do not expire. A key stays valid until it is revoked, either by you or by a plan change:

• Moving from Agency to Professional revokes every key that has the write scope.
• Moving to a plan without API access revokes every Data API key in the workspace.

Keys revoked by a plan change are flagged in the API keys panel so you can create replacements with the scopes the new plan allows.

Rotation

To rotate a key, create a new one, update your integration to use it, then revoke the old one. Revocation takes effect on the next request. Rotate at least once a year, and immediately whenever a key may have been exposed.

Losing a key

Revoke a leaked key immediately from the API keys panel. Every later request with that key fails with 401 invalid_api_key. Create a new key and update your integration.