Skip to main content

Open in AthenaHQ

app.athenahq.ai/settings/api

​
Purpose

Lets organization and website admins create and manage API keys, view API/MCP/Looker Studio setup instructions, and configure embed (iframe) credentials for embedding the AthenaHQ dashboard elsewhere.

​
What’s on the page

  • API permissions banner: A dismissible notice explaining that API keys bypass member role and permission restrictions.
  • View-only banner: A floating pill shown to members who can view API settings but do not have write access.
  • Tabs (API keys / Embed): Switches between managing API keys and managing embed domains/tokens. Only shown when the organization also has embed access.
  • API keys panel header: Shows the total count of keys, a “Guides” dropdown (containing “MCP setup”, “Looker Studio setup”, and “API documentation”), and a “Create API Key” button.
  • API Keys table: Lists all API keys for the organization or website scope.
    • Name: The user-assigned label for the API key.
    • Key: Masked key prefix shown as a code chip. The full secret is never re-displayed.
    • Websites: Which websites the key can access. Displays an “All Websites” badge, “None”, or up to 4 website logos plus a “+N” overflow count with a tooltip listing the rest.
    • Created: Date the API key was created.
    • Created By: Email of the user who created the key.
    • (actions): A ⋯ (kebab) menu with “Edit” and “Delete” actions. Disabled unless the current user has permission to mutate that specific key.
  • Locked API upsell: If your organization is on the Free plan or lacks API access, a splash screen is shown instead of the API keys panel. It displays a “Get API access” (or “Subscribe”) button for admins, or a “Contact Team” button for non-admins.
  • Embed tab: Allowed domains: Lists domains permitted to embed the Athena dashboard via iframe, with an “Add Domain” flow.
    • Domain: The https:// (or http:// for localhost) domain permitted to embed the dashboard, alongside the date it was added.
    • (actions): A ⋯ menu with a “Delete” action.
  • Embed tab: Embed tokens: Lists embed auth tokens used to authenticate requests.
    • Name: Token label.
    • Status: Badge reading “Active” (indigo) or “Paused” (orange).
    • Last used: Date of last use, or “Never used”.
    • Created: Creation date (appears when hovering over the row).
    • (actions): A ⋯ menu with “Pause” (or “Unpause”) and “Delete” actions.
  • Embed tab: How to embed Athena: An accordion section containing the iframe snippet, parameter reference, and a backend JWT-signing code example.

​
What you can do here

  • Dismiss the API permissions banner: Click the “X” (Dismiss) button to hide the banner permanently.
  • Create an API key: Click “Create API Key” to open a dialog. You can name the key, choose the access scope (“All websites” or “Specific websites”), and select websites. On submit, the generated secret is shown exactly once.
  • Edit an API key: Inside the ⋯ menu on a key row, click “Edit” to rename the key or change its website access scope.
  • Delete an API key: Inside the ⋯ menu on a key row, click “Delete”. This requires confirmation (“Are you sure you want to delete ‘<key name>’? This action cannot be undone.”).
  • View MCP setup: Inside the “Guides” dropdown (or the empty state shortcut card), click “MCP setup”. This opens a dialog with the Claude.ai connector URL and a generic MCP client config to copy.
  • View Looker Studio setup: Inside the “Guides” dropdown (or the empty state shortcut card), click “Looker Studio setup”. This opens a dialog with connection instructions.
  • View API documentation: Inside the “Guides” dropdown (or the empty state shortcut card), click “API documentation” to open the docs in a new tab.
  • Upgrade to unlock API access: If the feature is locked, click “Get API access” or “Subscribe” to view a live prorated price quote and start the checkout process.
  • Contact Team: If you are not an admin and the API is locked, click “Contact Team” to open a scheduling widget.
  • Switch tabs: Click “API keys” or “Embed” to switch between the two panels.
  • Add an embed domain: On the Embed tab, click “Add Domain”. Enter the domain, optionally generate a token, and copy the provided credentials.
  • Delete an embed domain: Inside the ⋯ menu on a domain row, click “Delete”. This requires confirmation (“Are you sure you want to delete <domain>? This will prevent embeds from this domain from loading.”).
  • Create an embed token: On the Embed tab, click “Create Token”. Enter a name and copy the generated secret/JWT secret/iframe snippet.
  • Pause / Unpause an embed token: Inside the ⋯ menu on a token row, click “Pause” or “Unpause” to toggle its ability to authenticate embed requests.
  • Delete an embed token: Inside the ⋯ menu on a token row, click “Delete”. This requires confirmation (“Are you sure you want to delete the token ‘<token name>’? This action cannot be undone.”).
  • Copy credentials: Use the copy buttons provided in the dialogs and the “How to embed Athena” accordion to copy tokens, secrets, or URLs.
  • View embed instructions: Click the “How to embed Athena” accordion to expand iframe usage instructions.

​
Data shown

  • Your organization’s API keys (scoped to the entire organization or specific websites).
  • The websites accessible to you and your organization.
  • Website logos corresponding to the websites an API key can access.
  • Your organization’s embed-allowed domains and embed auth tokens.
  • A live billing quote if you are purchasing API access.

​
Common workflows

Create and copy a new API key
  1. Click “Create API Key”.
  2. Enter a name.
  3. Choose “All websites” or “Specific websites” (organization admins only; website members are scoped automatically).
  4. Select websites if scoped.
  5. Click “Create key”.
  6. Copy the one-time secret shown in the success dialog.
  7. Click “Done”.
Set up an MCP or Looker Studio integration
  1. Open the “Guides” dropdown (or click the shortcut card if you have no keys).
  2. Choose “MCP setup” or “Looker Studio setup”.
  3. Follow the copyable connection URL/config or step-by-step instructions.
  4. (If using a generic MCP client) create an API key first and paste it into the configuration.
Upgrade to unlock API access
  1. Navigate to the API settings page and see the locked API upsell.
  2. If you are an admin: click “Get API access”, review the live price quote, and click “Subscribe”.
  3. If you are a non-admin: click “Contact Team” to schedule a call.
  4. On success, the API keys panel replaces the upsell.
Embed the Athena dashboard on a partner site
  1. Switch to the “Embed” tab.
  2. Click “Add Domain” and enter the target domain.
  3. Continue to generate a token for that domain.
  4. Copy the embed token, JWT secret, and iframe snippet.
  5. Implement backend JWT signing per the shown Node.js example.
  6. Paste the iframe snippet into the partner site.
Revoke a compromised or unused API key
  1. Locate the key row in the API Keys table.
  2. Open the ⋯ (kebab) menu.
  3. Click “Delete”.
  4. Confirm deletion in the dialog.

​
Empty, loading, and error states

  • Empty:
    • API keys: Shows a key icon, “Create your first API key” heading, description, “Create API Key” button, and shortcut cards for MCP, Looker Studio, and API docs.
    • Domains: Shows a globe icon and “No domains added yet”.
    • Tokens: Shows a key icon and “No tokens created yet”.
  • Loading: Shows a centered spinning loader while organization, website, or permission data resolves.
  • Error: Loading and updating errors surface as toast notifications at the bottom of the screen (e.g., “Failed to add domain”, “Failed to create token”, “Failed to update API key”).
  • Linked from: Settings navigation (Settings > API) and the direct URL /settings/api.
  • Links to:
    • AthenaHQ API documentation (external site, docs.athenahq.ai).
    • Cal.com scheduling widget (Contact Team).
    • Stripe checkout (if purchasing API access and no card is on file).

​
Common support questions

Why can’t I see the “Create API Key” button? You may not have the necessary write permissions for the API category. A “View-only” banner will appear at the bottom of the screen if you only have view access. Where is the Embed tab? The Embed tab is completely hidden (not just locked) if your organization’s subscription plan does not include the embeddable dashboard feature, even if API access is unlocked. I forgot my API key or embed token secret. Can I see it again? No, for security reasons, generated API keys, embed tokens, and JWT secrets are shown exactly once at creation time. If you lose one, you must delete it and create a new one. Why does the API keys page show an upgrade screen? API and MCP access are paid features. If your organization is on the Free plan or lacks the API entitlement, the entire page is replaced by the upsell screen instead of your keys. How do I restrict an API key to specific websites? When creating or editing an API key, select “Specific websites” under the “Access scope” section, then check the boxes next to the websites you want the key to access. Note that external website members can only create keys scoped to websites where they hold API write permissions.