Authentication and API key management

Before you start

Use integration-management permission and select the correct business and integration. The platform supplies supported authentication methods and key scopes for the integration type. Provider OAuth, integration API keys, HMAC secrets, and signed-in dashboard sessions are different credentials.

Create a scoped key

1. Open Integrations, select the integration, and open API Keys.
2. Create a key with a descriptive name, the scopes actually needed, and an offered expiration period.
3. Copy the full key when it is displayed. The normal key list exposes its prefix and metadata, not the full secret.
4. Store it in your server-side secret storage. Do not embed it in a public widget, browser code, screenshots, or a knowledge file.
5. Test the intended operation using the authentication contract for that integration.

Rotate or revoke

Create a replacement, update the consuming server, verify a successful operation, then revoke the old key. Review last-used and expiration information. Revoking a key can stop its integrations immediately; inspect dependent services before doing so.

HMAC and OAuth

Use the verified signing reference for HMAC header names, signed bytes, timestamp tolerance, and the difference between inbound and outbound secrets. Use the dedicated channel/calendar connection flow for OAuth rather than pasting a provider token into an API-key field.

Troubleshooting

Check the business/integration pairing, key state, expiry, scopes, and exact server error. Never send a full key to support. Use developer reference for the boundary between inspected frontend operations and external API contracts.