Settings: API Keys

API Keys

API keys are used to authenticate requests to the Tellescope API. For example, when connecting a custom form webhook or a third-party integration. This guide covers where to generate your own API key, and how organization admins can review and manage API key usage across the whole organization.

---

Generating a Personal API Key

Each user can generate their own API keys for use in integrations and development.

1. Navigate to Settings in the left sidebar
2. Select the API Keys tab
3. Click "Generate API Key"
4. Click "Show API Key" to reveal the secret key, and copy it for use in your integration

Notes:

• Each user can have up to 10 active API keys at a time.
• API Keys are specifically scoped to the user and organization that generated the key.
• Requests made with an API key have the same data access permissions as the key's creator's role; no more, no less.
• If the user who created a key is removed from the organization, that key stops working immediately.
• The Key ID shown in the table is for reference / identification only, it is not used to authenticate requests. Use the Secret Key instead.
• You can delete a key at any time from this same screen. Key deletion cannot be undone, and any integration using that key will immediately stop working.
• We recommend generating a separate, dedicated key for each integration (rather than reusing one key across multiple integrations), so that a single key can be revoked without disrupting others.

---

Organization-Wide API Key Management (Admins)

Organization admins can view and audit all API keys created across the organization, including who created each one, and revoke any key directly, without needing access to the key-owner's account.

1. Navigate to Organization in the left sidebar (visible to admins only)
2. Under the Admin section, select API Keys

This page shows:

• A summary count of API keys across your organization, broken down by who created each one
• A table listing every key's corresponding Key ID, user (Created By), and Created date
• A Delete action for each key

Deleting a key here immediately revokes it. Any integration relying on it will stop working, so confirm the key is no longer in use before deleting.

Note: this page is for reviewing and revoking existing keys only. It does not generate new keys or create keys on behalf of another user. To generate a new key, each user must do so individually from their own Settings > API Keys tab, described above.

---

Security Best Practices

• Never expose API keys in client-side code. Keys should only be used in server-side integrations or backend code, never embedded in frontend JavaScript, mobile apps, or anywhere else a user could view page/app source.
• If a key is ever exposed, delete it immediately from Settings > API Keys (or have an admin delete it from Organization > Admin > API Keys) and generate a replacement. Don't assume a leaked key is safe just because it hasn't been misused yet.
• Use one key per integration. As noted above, this limits the blast radius if a single key needs to be revoked.
• Don't share API keys between users. Since keys are scoped to the user that created them (see above), sharing a key defeats that scoping. Actions taken with a shared key are attributed to its original creator, and access can't be individually revoked for one person without breaking it for everyone using it. If multiple people or systems need API access, generate a separate key for each.
• Never share API keys outside your organization, including with vendors or partners. If a third party needs access, they should be given their own credentials setup rather than a copy of your key, so access can be scoped and revoked independently.