Open Settings → Advanced & security → API keys to make a key for something that is not a browser: a script, a spreadsheet, your website. A key lets that program read or change your data with exactly the permissions you choose. How a program uses a key is in the API reference.
Who can make and revoke keys
You need Configure on at least one workspace. Without it the page says You need admin access to at least one module to create an API key.
A key can never do more than the person who makes it. In the permission grid, anything you do not have yourself is greyed out, because a key you make cannot have it either.
Making a key
Start a new key
Press New key. The New API key card opens.
Say what it is for
Under What is it for?, type a name, such as Website adoptable list. It is how you tell keys apart later, up to 100 characters.
Choose what it may do
Under What may it do?, tick what the key may do in each workspace. Choose at least one.
Choose when it expires, if ever
Expires is optional. Leave it empty for a key that does not expire on its own.
Create it and copy it
Press Create key, then Copy, and keep the key somewhere safe before you press I’ve saved it.
What a key may do
The grid under What may it do? has a row for each workspace and three columns:
Ticking Configure ticks Change and See too, and ticking Change ticks See: a key cannot change what it cannot see. Unticking See clears the row.
A key reaches the workspaces, and tasks, activity, the calendar, and forms and their submissions, as far as its permissions allow. It never reaches your team members, roles, organization settings or other keys, whatever you tick.
The permissions are fixed when the key is made. If the person who made it later loses a permission, the key keeps it. Revoke the key if that matters.
The key is shown once
When you press Create key, the key appears in a panel headed Copy “Website adoptable list” now. This is the only time it is shown. RescueConsole keeps only a fingerprint of it, so it cannot be shown again or recovered. If you lose it, revoke it and make another.
The panel stays until you press I’ve saved it.
A key is a password that does not expire on its own and cannot be recovered. Keep it out of anything public: a web page’s code, a shared document, a public code repository. Revoke it the moment you suspect it has been seen.
Where a key works
A key works only at your own organization’s address. The same key sent to any other organization’s address is not accepted.
The list of keys
Each key in the list shows its name, the first few characters of the key so you can match it to the one a program holds, what it may do, who created it and when, when it was last used or that it was never used, and when it expires. A key past its expiry date is marked Expired; a revoked key is marked Revoked. A key that was never used is often one nobody needs.
Expiry
A key with an Expires date works until the end of that day, in UTC, and then stops. You cannot choose a date already past. An expired key stays in the list, marked Expired. To keep a program working, make a new key before the old one expires.
Revoking a key
Press Revoke beside the key. The row says Anything using it stops working.; press Revoke again to confirm, or Cancel.
Revoking takes effect on the very next request. It cannot be undone: a revoked key never works again, so a program that still needs access needs a new key. The revoked key stays in the list, with who made it and when it was last used, as a record that it existed.