Workspace API keys belong in protected server-side integrations. Use Widget generator for a public embed instead, and obtain service-specific API documentation before building requests.
Before you begin
You need administrator access and an approved server-side integration. This guide is not an API endpoint reference.
Step by step
- Open the workspace API key area in Settings and confirm the active workspace.
- Use Create API key only when you have a specific integration to configure. Treat the resulting value as a secret.
- Store the key in your server’s secret manager or protected environment configuration. Do not put it in widget HTML, mobile-app source, browser code, logs, or public documentation.
- The interface documents the header format
Authorization: ApiKey <key>and the gateway route pattern/api/v1/external/{service}/…. Obtain the service-specific API documentation before making requests. - If a key is exposed, contact your administrator to replace it and update the integration. Do not paste the exposed value into a support request.
What to check
Only the intended server-side service can read the key, and the workspace identity matches the integration.
Need to troubleshoot?
I need a complete endpoint example
Ask for the current API reference for your service. A route pattern does not define request fields or supported operations.
I am installing the chat widget
Use Widget generator instead. The public widget identity does not require putting an API key in the browser.