API Keys

An API key is a per-integration credential you generate from the dashboard. Name each one after what uses it, so revoking later is a clean decision rather than a guess.

Creating a key

Dashboard → API Keys → New key. The full value is displayed exactly once, at creation:

This is not a display limitationConnecfy stores only a one-way hash of your key, never the raw value. There is no "reveal" button to come back to later because the plaintext genuinely doesn't exist anywhere after that first response. If you lose it, the only path forward is revoking it and creating a new one.

Copy it into a password manager or your secrets store immediately. Every key you've created afterward shows only a masked fingerprint (like sk_4f21a0…9c3d) — enough to recognize which key is which, not enough to use.

Storing it safely

Never put a key in source code, a commit, a client-side app, or a URL. Use an environment variable:

bash

export CONNECFY_API_KEY="your-key-here"

python

import os
api_key = os.environ["CONNECFY_API_KEY"]

Rotating a key

There's no one-click "rotate" — rotation is two ordinary steps: create the new key, update whatever calls the API to use it, then revoke the old one once you've confirmed the new one works. Keeping both active briefly during the switch is normal and safe; they're independent credentials.

Revoking a key

Dashboard → API Keys → Revoke, on the specific key. It stops authenticating immediately and permanently — revocation can't be undone, so if you're not sure, create a replacement first. Revoking one key never touches any other key on the account.

Using more than one

There's no limit on how many active keys an account can hold. One per integration is the practical convention — it makes "which system is calling us" traceable and means revoking one doesn't take down everything else.