Skip to content
User Portal Documentation

API Keys

An API key is a secret string that lets another application - a CRM, a reporting script, a wallboard - use the platform’s APIs on your behalf, instead of signing in with your user name and password. Each application gets its own key, so its access can be limited and taken away without changing your password. A key acts as you, with your rights.

Creating a key

Click Add and fill in:

  • Name (required) - which application the key is for.
  • Scopes - what the key may be used for:
    • Configuration API - the REST API for configuration. Checked by default.
    • Read live call state, Control calls and Receive live call events - the Telephony API, using your own rights in the Team Panel. These work only when your organization has the Telephony API turned on.
  • Expires - optional; the key stops working at the end of that day. Leave it empty for a key that does not expire.

The system generates the key and shows it once. Copy it into the application straight away; it is not shown again. A lost key cannot be recovered - delete it and create a new one.

The list shows each key’s Name, Scopes, Expires, Status, Created and Last Used, among other columns.

Revoking a key

Open the key and check Revoked. A revoked key is refused everywhere; clearing the checkbox makes it work again. Status in the list shows which keys are revoked.

Best practices

  • Create one key per application, so one can be revoked without breaking the others.
  • Treat a key like a password. Keep it out of source code, shared documents and screenshots. If it is exposed, revoke or delete it and create a new one.
  • Give a key only the scopes it uses. A reporting script needs Configuration API; a wallboard needs Read live call state and Receive live call events.
  • Set Expires on keys given out for a limited time, and delete keys for applications no longer in use.