An API key lets your own systems do what you would otherwise do by hand: read reviews, reply to them or assign them, and read your rules and usage. Keys live in Settings > Developers.
What you need: you have to own the account, or be an administrator on it. If you buy through a provider, they decide whether this location (workspace_id in the API) can hold keys at all; when it is switched off, the tab says so and there is nothing to create.
Make a key
- Open Settings > Developers.
- Press Create key.
- Give it a label. Name it after the thing that will use it, not after yourself: the label is what the revoke dialog will ask you about a year from now.
- Tick only the scopes that thing actually needs.
- Press Create key again.
The create a key dialog with a label field and the scope checkboxes below it.
Store it once
The full key is on screen exactly once. Nobody can show it to you again, us included, so copy it straight into your secret manager or your gateway before you close the dialog.
The dialog after a key is created, showing the full key once with a warning above it.
If you lose a key, revoke it and make a new one. That is the whole recovery path, and it is the same one every serious API gives you.
What each scope allows
reviews:readreads reviews and who wrote them.reviews:actreplies, assigns, archives and approves.rules:readandrules:writeread and edit your automation rules.usage:readreads your credits, what has been used and what is left.events:readpulls the activity log instead of waiting for a webhook.webhooks:writemanages the endpoint we post events to.
An agency key adds the scopes that reach across client locations, and it carries a list of the locations it may name, because that list only exists one level up.
Endpoint reference
Settings > Developers carries a reference of every endpoint a key like yours can call: the base URL to send to, the method and path of each one, the scope a key needs to hold for it, and a line on what it does. It is generated from the API itself, so it never lists an endpoint that has been renamed and never misses one that was added last week. The base URL at the top is the one your account should use, which is not always the same address another account is given.
The API reference
The API docs button on the endpoint reference card opens the full reference for your account: every endpoint with its parameters, an example request and response, and ready-made code samples in fifteen languages. It is built from the same source as the list on the screen, so the two never disagree, and it carries the cross-cutting rules as well: pagination, rate limits, idempotency, the error shape and the webhook envelope. Open it beside whatever you are building and copy the sample for your language straight out of it.
What it costs
Every action the API takes for you counts as 1 credit: a reply, an assignment. Reading costs nothing, so pulling reviews, rules and usage on a schedule is free however often you do it. Writing a rule is free as well; the rule firing later is not.
If your credits run out, reads keep answering and anything that acts on a review comes back with an error until there are credits again.
The Developers tab in settings, showing the API keys card with one key and its scope chips.
Revoke a key
Press Revoke on its row and confirm. It stops working immediately, and anything still calling with it starts getting 401 errors on the next request. There is no undo, so revoke the key you meant to: the dialog names it.
Revoke a key whenever the system that held it is retired, whenever somebody who had access to it leaves, and immediately if you think it has leaked. A key that has not been used in months is worth revoking too; the Last used column is there to make those easy to spot.
Webhooks
Under the keys card you can point us at one HTTPS endpoint and choose which events we post to it. Every post is signed, and the delivery list shows what came back so you can tell a bad payload from a bad endpoint. See Outbound webhooks for the event list, the signature, secret rotation and the log.