Skip to content

API keys

An API key authenticates programmatic requests against one workspace. Keys are scoped, owned by a user, optionally time-limited, and revocable.

They live at Settings → API keys (/settings/api), which requires admin access and the API_ACCESS entitlement — Business or Enterprise.

  1. Go to Settings → API keys.
  2. Select Create API key.
  3. Give it a name that identifies what will use it — Slack digest bot, not key 2. Up to 100 characters.
  4. Choose an Owner. The default is you. Admins can mint a key on behalf of another workspace user; the picker is hidden if you cannot list users.
  5. Choose an expiry: Never, 30 days, 90 days, or 1 year.
  6. Select the scopes the key needs. At least one is required.
  7. Select Create key.

The plaintext key is then shown once. Copy it into a password manager or secret store before closing the dialog — there is no way to see it again. If you lose it, revoke the key and create another.

After that, the list shows only the key’s prefix.

Scopes follow a read:<resource> / write:<resource> form. A request using a scope the key was not granted is rejected.

ScopeGrants
read:surveysList and read surveys, questions, sections, and templates
write:surveysCreate, update, and close surveys — required for any write action on a survey
read:responsesRead individual responses and their conversation threads
read:themesRead clustered themes, sentiment, and surfaced signals
read:membersList workspace users, teams, and groups

The picker groups these into Surveys, Responses, Insights, and Organization, with a select-all control per group and a running “n of 5 selected” count.

Grant the narrowest set that works. A digest script that only reads themes does not need write:surveys, and scoping it that way means a leaked key cannot close a live survey.

A key does not expand access. It is bounded twice over:

  • By its scopes, as above.
  • By the permissions of the user it belongs to. A key owned by someone whose role cannot view survey results does not gain that ability by holding read:responses. See Roles and permissions.

Key creation and revocation are both written to the audit log, recording the scopes granted, the owner, and the expiry.

Each row shows the key name, its prefix, its scopes as pills — the first three, then a +N — and four dates.

FieldMeaning
OwnerThe user whose permissions the key inherits
CreatedWhen it was minted
Last usedWhen it last authenticated a request, or Never
ExpiresIts expiry date, or Never

A Revoked badge marks a key that has been revoked; an Expired badge marks one whose expiry has passed. Revoked keys stay in the list as a record.

Last used is the field to check before revoking something you’re unsure about. A key that has never been used is safe to remove.

  1. Find the key and select Revoke.
  2. Confirm.

Revocation takes effect immediately — every subsequent request with that key is rejected — and cannot be undone. Rotating a key means creating the replacement, moving your integration over, and then revoking the old one.

Revoke a key as soon as it is no longer needed, and whenever the person who owned it leaves the workspace.