The API authenticates with a personal API key, sent as a bearer token.
Creating a key
Go to Settings → API keys
The tab lists any keys you already have, showing their prefix and when each was last used — so you can tell which is which without storing the secrets anywhere.
Create a key
Give it a name that says where it will be used — “Zapier”, “nightly export”, “Ben’s laptop”. You’ll thank yourself when it’s time to revoke one.
Copy it now
The key is shown once. We store only a hash of it, so we cannot show it to you again. If you lose it, revoke it and create another.
cc_.
Using a key
What a key can reach
A key acts as you. It can reach exactly what you can reach — your personal projects, and organization projects your teams give you access to — and no more. It does not inherit an organization role you don’t have.
Revoking a key
Settings → API keys → revoke. It stops working immediately.
Revoke a key when the integration using it is retired, when someone who had it leaves, or any time you’re not certain where it ended up. Creating a replacement takes seconds, so there is no reason to hesitate.
Treat a key like a password. Don’t commit one to a repository, don’t paste one into a shared document, and don’t put one in a client-side application where a visitor can read it.
Keys can’t manage keys
The key endpoints themselves require a signed-in session, not an API key. A leaked key cannot be used to mint, list or revoke other keys — it is limited to whatever it can already do, and cannot widen its own reach. 
