Table of Contents
API Keys
An API key lets a script or another system use one project through the API without signing in, for example to add sign-ups from your website or to send a campaign from your CRM.
Keys are managed in the project's Settings, in the API keys section. Everyone in the project can see the list; only owners can create and revoke keys.
Create a key
- Open the project and select Settings in the sidebar.
- Under API keys, type a Key name that says what the key is for, such as "Website sign-ups" (up to 100 characters).
- Select Create key.
A panel appears: Copy this key now. You won't see it again. The key is already selected in the box.
- Select Copy to put it on the clipboard. If your browser doesn't allow that, copy the selected text yourself.
- Paste it where your script reads it from, such as a password manager or the server's settings.
- Select Done. The key disappears from the page, and Postak can't show it again.
Postak stores only a fingerprint (a hash) of the key, so nobody can read it back later, not even an administrator. If you lose a key, revoke it and create a new one.
A project can have up to 50 active keys.
The key list
| Column | Shows |
|---|---|
| Name | The name you gave the key. |
| Key | The first part of the key (for example postak_ab12cd34…), so you can match it to the key your script uses. |
| Created | When, and by whom. "a removed user" means that account no longer exists. |
| Last used | When the key was last accepted, or Never. Updated at most once a minute. |
| Status | Active, or Revoked on a date. |
Revoke a key
Select Revoke next to an active key and confirm. Anything that uses the key stops working right away: its requests get "Invalid API key.". A revoked key stays in the list, so you can see when it was revoked, and it can't be turned back on. Create a new key instead.
Revoke a key when an integration is retired, when someone who knew the key leaves, or if the key may have been seen by someone it wasn't meant for.
Good to know
- A key belongs to the project, not to the person who created it. It keeps working if that person leaves the project or their account is removed. Owners decide when to revoke it.
- A key only works for its own project, and only on the routes listed in Using the API. It can't manage members, forms, or other keys.
- Keep keys on servers you control. Never put one in a web page or an app that runs on other people's devices.
- Use one key per integration, so revoking one doesn't stop the others.
- Deleting the project deletes its keys.
See Using the API for how to send a key with a request, examples, error answers, and rate limits.