API key

Each time you connect an automation, an AI agent or a reporting tool to another service, you are usually handing it a key. A leaked key lets someone else read your data or spend your money on that service until you revoke it.

How it works

You create a key in the settings of the service you want to reach. Your automation or script then sends it with every API request, usually in a header, and the service checks it before doing anything. Many services let you limit a key, for example to read-only access or to one project, and some let you set an expiry date.

You can revoke a key at any time and create a new one, which is called rotating it. To make rotation painless, save the key once in your automation tool's credential store or in an environment variable, and have every workflow refer to it by name.

Example

A small business owner connects her newsletter tool to an automation platform so new customers get added to her list. She creates a key in the newsletter tool that can only add subscribers, saves it in the platform's credential store as "newsletter-prod", and selects that credential in each workflow. When her freelancer's contract ends, she revokes the key, creates a new one and updates the single saved credential. No workflow needs editing.

Common mistake

Pasting a key into an AI chat, a screenshot or a shared workflow so someone can "take a look". Treat any key that has been exposed this way as compromised: revoke it straight away and issue a new one.