An API key lets your own software talk to your platform through the REST API, for example to read members, enroll someone in a course or connect a WordPress site. Each key is a secret password for a program, so you decide per key what it may do and you can replace or delete it at any time.
Who can manage API keys
API sits in the Integrations & API block of the settings menu. Your role needs Manage API Keys in addition to Update Platform Settings. This permission is never available to a custom role, so only the built-in Owner and Admin roles can work here. The same permission also opens OAuth Apps and Single Sign-On.
API access depends on your plan. If your plan does not include it, the page shows "API access is included in every paid plan. Upgrade to create API keys." together with Change plan, and New API key stays disabled. Keys that already exist are refused by the API until the plan includes it again.
Creating a key
Click New API key. The dialog Create API Key opens.
- Enter a Key name that tells you later who uses the key, for example the tool or the website it belongs to. The name is required.
- Decide what the key may do. A new key starts with full access, so every permission is selected.
- Click Create.
To restrict the key, click Limit to specific permissions. All permissions are cleared, and you pick the ones you need. The permissions are grouped by area, such as Members, Groups, Courses or Payments, and each area lists actions like View or Manage with a short description. Select all and Deselect all switch a whole area at once. A counter shows how many permissions the key has. A key needs at least one permission, and Reset to full access selects all of them again.
After you click Create, the dialog Your new API key shows the full key once. Copy it and store it somewhere safe. The list shows only the last four characters afterwards, and nobody can display the full key again.
Using a key
The box API documentation above the list shows the Base URL of the API with a copy button, and Open documentation leads to the interactive reference with all endpoints.
Send the key with every request, either as a Bearer token in the
Authorization header or in the X-Api-Key header. Keys start with mak_.
A request that needs a permission the key does not have is refused.
A key is tied to the team member who created it. If that person no longer belongs to your workspace, the key stops working, so create keys for long-running connections with an account that stays.
The list shows each key with Name, Key, Last used and Created. Last used is updated at most once a minute, which is enough to see whether a key is still in use.
Changing, rotating and deleting a key
Click a key in the list, or use Edit, the pencil icon in its row, to change its name or its permissions. Changes take effect with Save.
If a key may have leaked, rotate it. Rotate key in the same dialog asks: "Rotate this key? The old secret will stop working immediately and external integrations will need the new one." After you confirm, the new key appears once in Your new API key. Name and permissions stay the same, and Last used starts over. Enter the new key in every tool that used the old one.
To remove a key, use Delete, the trash icon in its row, or Delete in the open dialog, and confirm. Every tool that still uses it is refused from then on.
OAuth apps, Single Sign-On and webhooks
Pasting a key is not the only way to connect:
- OAuth Apps let other MemberAreas connect your software with OAuth instead of a pasted API key.
- Single Sign-On logs members in from another system. It is described in Login, registration and SSO.
- Webhooks for member and payment events have their own page under Settings > Webhooks, which appears once Payments is on.