Skip to main content
An API key connects a backend to one domain and a precise set of permissions. Complete secrets are displayed only when created.

Recommendation

Create at least:
  • one key per environment with only the Conversations (runtime) permission;
  • a separate key with Read (configuration:read), Edit (configuration:write), or Publish (configuration:publish) only if you automate configuration;
  • no public key in a browser or mobile application.
The list displays only a masked form, final characters, status, and non-sensitive metadata. Revocation immediately blocks new calls.

Secure an API key

Review storage, rotation, and exposure-response practices.