Good to know
- The full key is shown once. Only a hash of it is kept, so a lost key cannot be recovered: revoke it and make another.
- A key acts as the member who made it. No key can reach billing, members, invitations, exports, branding, status page changes or the organisation settings.
- When the terms change in a way that needs your acceptance, owners are asked in the app first. If the owner who made a key has still not accepted 30 days after the new terms took effect, that key can only read until they do (a write answers 403
terms_acceptance_required). Accepting the terms in the app restores it at once. - Requests are limited per key and per organisation. A refused request is a 429 answer with a
Retry-Afterheader that says how many seconds to wait. - Creating a site accepts an
Idempotency-Keyheader, so a request you repeat after a network error does not create it twice. - To let an AI assistant such as Claude read your data, use AI assistants in the app: it makes a read key and gives the set-up text (connect an assistant).
- Keep a key like a password: put it in the secret store of the tool that uses it, never in a page, a repository or a support message. A message that contains a key is refused.