Name the integration
Check the active brand before creating a key. Give it a recognizable name for the system that will use it. The raw key is displayed once and cannot be retrieved later from its stored hash. Keep it in a secret manager or protected server environment.
Replace without losing the working connection
For a routine rotation, verify the replacement before revoking the old key. An exposed key is different: revoke it immediately, then restore the integration using a new secret.
- Create the replacement in the intended brand.
- Update the integration's protected credential configuration.
- Make an authenticated read and confirm the returned brand records.
- Revoke the old key and remove stale copies from your systems.
Keep keys off public surfaces
Do not put a key in browser JavaScript, an iframe URL, a public widget, source control or an assistant's ordinary chat text. Give a compatible client the key only through its secure credential settings. A webhook signing secret is a different credential with a different purpose.
Common questions
Can I retrieve a key I forgot to copy?
No. Create a replacement, configure it securely and revoke the unused key. Do not share another person's login as a workaround.
Need a hand?
Use Feedback in your dashboard if a guide does not answer your question. Include the page, what you expected and what happened. Never include a password, API key, account number or private payload.
Open API & connections