Skip to main content
The API authenticates with a personal API key, sent as a bearer token.

​
Creating a key

1

Go to Settings → API keys

The tab lists any keys you already have, showing their prefix and when each was last used — so you can tell which is which without storing the secrets anywhere.
2

Create a key

Give it a name that says where it will be used — “Zapier”, “nightly export”, “Ben’s laptop”. You’ll thank yourself when it’s time to revoke one.
3

Copy it now

The key is shown once. We store only a hash of it, so we cannot show it to you again. If you lose it, revoke it and create another.
Keys start with cc_.

​
Using a key

​
What a key can reach

A key acts as you. It can reach exactly what you can reach — your personal projects, and workspace projects your teams give you access to — and no more. It does not inherit a workspace role you don’t have.

​
Revoking a key

Settings → API keys → revoke. It stops working immediately. Revoke a key when the integration using it is retired, when someone who had it leaves, or any time you’re not certain where it ended up. Creating a replacement takes seconds, so there is no reason to hesitate.
Treat a key like a password. Don’t commit one to a repository, don’t paste one into a shared document, and don’t put one in a client-side application where a visitor can read it.

​
Keys can’t manage keys

The key endpoints themselves require a signed-in session, not an API key. A leaked key cannot be used to mint, list or revoke other keys — it is limited to whatever it can already do, and cannot widen its own reach.