Create and manage API keys
Authenticate your own scripts and servers against your help.ai workspace.
Last updated
API keys let your own scripts and servers call help.ai, for example to read form submissions into your CRM. Each key belongs to one workspace and to the person who created it.
API keys or deployment keys?#
Create a key#
- Open API Keys and select Create API Key.
- Enter a Name of up to 100 characters, such as "CRM sync".
- Choose a Permission: Read, Write or Admin. It starts at Read. What a key can do, below, explains each.
- Add an optional Note for your team, up to 500 characters.
- Pick an Expiration date and time if the key should stop working on its own, or leave it empty for no expiration. Once set, an expiration can be moved but not removed.
- Keep Enabled on and select Create API Key.
A message confirms the new key and shows it in full. The key then appears in your API Keys list: Show API key reveals it and Copy API key copies it.
Anyone in the workspace, Viewers included, can create keys. Each person sees and manages only the keys they created.
Use the key#
Send the key in the x-api-key header of each request:
x-api-key: YOUR_API_KEYA key acts as you. It works only while the key, your account, the workspace and your membership are active, and until it expires. It never gives access to your other workspaces.
What a key can do#
A key's Permission limits your role in the workspace, and it never does more than you can:
With a key, only an Admin key can view or manage API keys, change your account details, accept or decline invitations, or create a workspace, so a Read or Write key can't reveal or make a stronger key. No key can change your email: sign in for that. Give each script the lowest permission it needs.
Manage keys#
From the row menu (⋯):
- Edit changes the name, permission, note, expiration or Enabled.
- Disable turns a key off right away, and Enable turns it back on.
- Delete removes the key for good. This can't be undone.
help.ai emails you when one of your keys is created, turned off or deleted.
Give each script its own key with an Expiration. If a key leaks, delete it right away and create a new one.