Skip to main content

​
API Key Authentication

All API requests must include an API key in the request headers. API keys are passed using the x-api-key header.

​
Creating API Keys

API keys can be created and managed through your organization’s dashboard.

Manage API Keys

Create, view, and manage API keys in your organization settings

​
API Key Scoping

API keys belong to an organization and can be scoped to specific websites within that organization. This allows for granular access control when managing multiple websites under a single organization.
  • Each API key is associated with an organization
  • Organizations can contain multiple websites
  • API keys can be scoped to one or more specific websites
  • Scoped API keys only have access to data from their assigned websites

​
Global vs. scoped keys

A global key covers the whole organization; a scoped key is limited to its assigned websites. Some organization-wide endpoints require a global key and reject a scoped one with 403 Forbidden: global API key required:
  • Role management — all /api/v1/roles endpoints
  • Organization members — /api/v1/organizations/members/{user_id} (update/remove)
  • Groups — /api/v1/groups management and group members
  • Organization and group invites — POST /api/v1/invites with type: "organization" or type: "group" (website invites also work with a scoped key that includes the target website)
Global keys are admin-equivalent — only an organization admin or owner can create one — so these endpoints enforce the same admin-level access as the dashboard.
Only organization admins can create, edit, or delete API keys. Ensure you have the appropriate permissions before attempting to manage API keys.