Skip to main content
An API key authenticates programmatic requests as its associated member and organisation. It does not bypass the endpoint’s permissions or make every platform operation available through key-based access. Use the API tab in this documentation for the current endpoint contract, including required fields and supported operations.

​
Create a key

  1. Open Settings → Developer → API keys with an account that has permission to manage keys.
  2. Create a key with a name that identifies the application or workflow using it.
  3. Copy the value when it is displayed and store it in your application’s secret store. The value is not available for later display.
Keep keys out of client-side code, shared documents, conversation messages, and source control.

​
Authenticate a request

Supported endpoints accept the key in the Api-key request header:
Use the base URL and request format in the current API reference. Confirm the intended organisation and the member’s permissions when diagnosing an access failure.

​
Rotate or revoke a key

Create a replacement key, update the consuming application, and verify a small request. Delete the old key once no application needs it. If a key is exposed, revoke it promptly and replace it in affected applications. A Dawn API key authenticates requests to Dawn. Credentials used by Dawn to access an external database or provider are managed separately in Connections → Credentials.