Skip to main content

Open in AthenaHQ

app.athenahq.ai/settings/api

​
Purpose

This page allows organization administrators and authorized members to manage programmatic access to their Athena data. It provides the tools to create and manage API keys, which are used to connect custom integrations, power live Looker Studio dashboards, or configure AI assistants using the Model Context Protocol (MCP). For organizations with the right subscription plan, this page also houses the “Embed” configuration. Here, customers can set up the required whitelisted domains and authentication tokens to securely embed the Athena dashboard directly into their own websites or platforms via an iframe.

​
What’s on the page

  • Tabs (API keys / Embed): Splits the page into two sections. This tab navigation only appears if your organization’s subscription plan includes embed access. If you don’t have embed access, you will only see the API keys section.
  • API keys panel header: Shows the total count of API keys, a “Guides” dropdown for setup instructions, and a primary “Create API Key” button.
  • API keys table: A list of all existing API keys for the organization.
  • Locked upsell: If your organization does not have API access enabled, the standard keys table is replaced by a large promotional section. This features an illustration, plan/pricing information, and a button to either purchase access immediately or contact the team.
  • Embed tab. Allowed domains: A section to manage the HTTPS domains that are permitted to embed your Athena dashboard.
  • Embed tab. Embed tokens: A section to create, pause, or delete the secure tokens used to authenticate embed requests from your allowed domains.
  • Embed tab. How to embed Athena: An informational accordion containing the HTML iframe snippet, parameter documentation, and a backend code example for signing JWTs.
  • View-only banner: A floating or inline pill that says “View-only · API”. It appears for users who do not have permission to make changes here, explaining they can look but not touch.

​
API keys table

  • Name: The display name given to the API key. You can click the header to sort by name.
  • Key: The first few characters of the API key, followed by dots (e.g., xyz••••••), displayed in a code block.
  • Websites: Shows which specific websites the key can access. If global, it shows an “All Websites” badge. If scoped to specific sites, it displays up to four website logos. If there are more than four, a +N badge appears, and hovering over it shows a tooltip listing the remaining website names.
  • Created: The date the key was generated. You can click the header to sort by date.
  • Created By: The email address of the user who generated the API key. You can click the header to sort by creator.
  • Actions (⋯): A kebab menu on the far right of each row containing actions to Edit or Delete the key.

​
What you can do here

  • Switch tabs: Click “API keys” or “Embed” to toggle between the configuration panels (if available on your plan).
  • View Guides: Click the “Guides ▾” button to open a dropdown menu. From here you can select:
    • MCP setup: Opens a dialog with your MCP server URL and a configuration snippet for AI assistants like Claude.
    • Looker Studio setup: Opens a dialog with step-by-step instructions for connecting Athena as a data source in Looker Studio.
    • API documentation: Opens the external API reference documentation in a new browser tab.
  • Create API Key: Click the button to open the creation dialog. You will name the key and choose its scope (either “All websites” or “Specific websites”). Once created, the full secret key is displayed for you to copy. If you lack permission, the button is disabled with the tooltip: “Only admins can create API keys”.
  • Edit API Key: Inside the ⋯ menu on an API key row, click Edit to rename the key or change which websites it has access to.
  • Delete API Key: Inside the ⋯ menu on an API key row, click Delete to permanently remove the key. A confirmation dialog will ask: “Are you sure you want to delete <key name>? This action cannot be undone.”
  • Subscribe / Get API access: If the feature is locked, clicking the primary purchase button opens a dialog showing a live prorated quote. Confirming will route you to a secure checkout or charge your card on file to instantly enable API access.
  • Contact Team: If the feature is locked and you are not an admin (or enterprise customer), clicking this button opens a scheduling widget to book a call with the Athena team.
  • Add Embed Domain: In the Embed tab, click “Add Domain” to register a new HTTPS domain. The dialog walks you through entering the domain and optionally generating an embed token immediately.
  • Delete Embed Domain: Inside the ⋯ menu on a domain row, click Delete. A confirmation asks: “Are you sure you want to delete <domain>? This will prevent embeds from this domain from loading.”
  • Create Embed Token: In the Embed tab, click “Create Token” to name and generate a new token. It will display the one-time secret, the JWT secret, and the iframe snippet for you to copy.
  • Pause/Unpause Embed Token: Inside the ⋯ menu on a token row, click Pause (or Unpause) to temporarily disable or re-enable the token without deleting it.
  • Delete Embed Token: Inside the ⋯ menu on a token row, click Delete. A confirmation asks: “Are you sure you want to delete the token <name>? This action cannot be undone.”
  • View embed instructions: Click “How to embed Athena” to expand the accordion and copy the iframe snippet and backend code examples.
  • Copy values: Throughout the page, clicking the copy icon next to keys, tokens, JWT secrets, iframe snippets, and MCP configurations will copy the value to your clipboard and display a “Copied!” tooltip.

​
Data shown

This page displays your organization’s generated API keys, registered embed domains, and active embed tokens. It also relies on your underlying user permissions to determine whether you have the “Write” access needed to generate new credentials, and reads your organization’s active subscription plan to determine if you are entitled to use the API and Embed features at all.

​
Common workflows

Creating an API Key for Looker Studio
  1. Navigate to Settings › API.
  2. Click the “Create API Key” button.
  3. Enter a memorable name (e.g., “Looker Studio Reporting”).
  4. Select whether the key should access all websites in your organization or only specific ones, then click “Create key”.
  5. Copy the generated secret key immediately and store it securely.
  6. Click the “Guides ▾” button and select “Looker Studio setup” for step-by-step connection instructions.
Setting up the Embeddable Dashboard
  1. Navigate to Settings › API and click the “Embed” tab.
  2. In the Allowed domains section, click “Add Domain”.
  3. Type the domain where you plan to host the iframe (e.g., internal-tools.company.com) and click “Add Domain”.
  4. On the next screen, click “Create Token” to generate credentials for this domain.
  5. Copy the Embed Token, the JWT Secret, and the iframe snippet provided. You will need to hand the JWT Secret to your backend developers so they can sign user sessions.
Revoking a compromised Embed Token
  1. In the Embed tab, scroll down to the Embed tokens list.
  2. Locate the token you want to disable.
  3. Click the ⋯ menu on the right side of the row.
  4. Click Pause to temporarily disable it, or Delete to permanently remove it and break any active integrations using it.

​
Empty, loading, and error states

  • Empty:
    • If you have no API keys, a large indigo key icon is displayed with the heading “Create your first API key”, followed by descriptive text and quick-link cards for MCP setup, Looker Studio, and API docs.
    • If you have no domains, a globe icon is shown with “No domains added yet”.
    • If you have no tokens, a key icon is shown with “No tokens created yet”.
  • Loading: While the page checks your permissions and subscription data, a centered animated spinner is shown. When keys, domains, or tokens are actively being fetched, “Loading domains…” or “Loading tokens…” text appears.
  • Error: Most errors display as toast notifications in the corner of the screen (e.g., “Failed to create API key” or “Failed to add domain”). If the live pricing quote fails to load during the API purchase flow, the Subscribe button disables and an inline message asks you to close and try again.
  • Linked from: The main Settings sidebar menu under “API”.
  • Links to:
    • The Billing page (via the “View plans” or upgrade flows).
    • External Athena API Reference Documentation (docs.athenahq.ai).
    • External documentation for claude.ai and modelcontextprotocol.io within the MCP setup guide.

​
Common support questions

Why can’t I click the “Create API Key” button? You need API “Write” permissions to generate keys. A tooltip on the disabled button will say, “Only admins can create API keys” or a floating banner will advise you to ask an org admin for access. Where is the “Embed” tab? The Embed tab only appears if your organization’s subscription plan explicitly includes the embeddable dashboard feature. If you don’t see it, your plan likely only covers standard API access. I forgot to copy my API key. Can I see it again? No. For security reasons, the full secret key is only displayed once immediately after it is created. If you lost it, you must delete the existing key and create a new one. My embed is showing a “Token has expired” error. How do I fix this? The backend JWT generated to authenticate your users expires in 4 hours. Ensure your backend is generating a fresh JWT on every page load rather than caching it statically. What does “API access bypasses member permissions” mean? It means that the API key acts as a system-level credential. Even if the person who created the API key is later restricted from viewing certain content, the API key itself will still be able to query all data for the websites it was scoped to.