My API keys and Member API keys

Console pages: My account › My API keys, Members & roles › Member API keys, and each organization's page in an environment console

Some apps that sign you in through Cbox ID have an API of their own. An API key lets your scripts and integrations call that API as you, without signing in. You create the key here; the app checks it with Cbox ID every time it is used.

These are not the API keys page under Workspace, whose keys are for your own code calling Cbox ID.

Creating a key

My account › API keys. The page appears once an app in your organization offers keys, and an app can link you straight to it.

1. If you belong to several organizations, pick the one the key should act in.
2. Pick the app.
3. Give the key a name that says what will use it, such as "Accounting sync".
4. Tick the permissions it needs. Only what you can do in that app yourself is offered, each with the app's own description. Tick as little as the job needs.
5. Choose when it expires: never, 30 days, 90 days, a year, or a date.
6. Create key, then copy it. It is shown once. Afterwards only its first characters are shown.

If you came from the app, a Back to link takes you there.

When a key is refused

The page says why. The usual one is a permission you do not hold in the app, for example because a colleague changed your role while the page was open. It is named in the message. Ask an admin for the role, or create the key without it.

What a key can do

A key can only do what you can do in the app, and never more:

• it carries only the permissions you ticked;
• if you lose a permission, the key loses it on its next use;
• if you leave the organization, or it is suspended, the key stops working. Being added back later does not revive it.

Revoking a key

Revoke a key the moment it leaks or its integration is retired. Anything still using it stops working at once. The list shows when each key was last used, which tells you whether anything still depends on it.

• Your own keys: My account › API keys.
• Everybody's keys in an organization: Members & roles › Member API keys, for owners and admins. The environment console shows the same list, as Member API keys, on each organization's page.

Admins can revoke any key in their organization. They cannot create a key for somebody else: a key acts as the person who holds it, so each person creates their own.

In the audit log

Creating and revoking a key are both in the organization's audit log, as api_key.created and api_key.revoked, with who did it. An admin revoking somebody else's key is recorded as the admin.

For app developers

An app offers keys once it has a key prefix: Developers › Applications › the app › Settings › API keys. For the whole integration, verifying keys included, see Let your customers create API keys.

Related

• API keys — the keys your own code presents to Cbox ID, which are a different thing.
• Members and invitations — a key stops working when its holder leaves.
• Audit log — every key created and revoked.