API keys
API keys authenticate calls to the REST API. Every key is created, and revoked, from the dashboard by a forum owner or admin.
Creating a key
Section titled “Creating a key”- Sign in to your dashboard.
- Open API keys in the sidebar (visible to owners and admins only).
- Click Create API key, give it a label describing what will use it (a CI pipeline, a support bot, an internal script), and pick a role. Optionally mark it read-only.
- Your new key is shown once, immediately after creation. Copy it somewhere safe.
That’s the only moment the key’s secret is ever displayed. It’s stored on our side as a one-way hash, not in a form we could show you again, so if you lose it there’s no way to recover it: revoke the key and create a new one instead.
Every key carries a role, the same vocabulary your team already uses, capped by whoever created it:
- Admin: matches the reach an owner or admin has in the dashboard: content, categories, tags, team, and settings, except billing and key management themselves. Only owners and admins can create keys in the first place.
- Agent: the day-to-day work an agent teammate does, answering and moderating content, but not changing categories, tags, team membership, or forum settings.
A key’s power is capped by its creator’s role at the moment each request is made, not fixed at creation time: an admin-role key made by an owner still acts as admin (a key never outranks the role it was assigned), and if its creator is later demoted, the key is capped at whatever the creator can do now. If a creator loses staff access entirely, whether removed from the team or moved to a role like billing-only or member, every key they made stops working immediately, the same as an unrecognized key. Removing someone from your team deletes every key they created outright. Review a person’s keys whenever you change their role.
Read-only
Section titled “Read-only”Any key, admin or agent, can also be marked read-only. A read-only key can only
fetch data (the REST API’s GET endpoints); anything that would change something is
rejected, regardless of what its role would otherwise allow. Use this for anything
that only needs to read, a reporting dashboard, a sync job, so a leaked key can’t be
used to change anything.
What a key can never do
Section titled “What a key can never do”A few things stay dashboard-only no matter how a key is scoped: billing, creating or revoking API keys, and your forum’s custom scripts. Custom scripts run arbitrary code on your portal pages, so they can only be set by a signed-in owner or admin in the dashboard, never through the API, even by an admin-role key.
Revoking a key
Section titled “Revoking a key”Click Revoke next to any key in the list. Revocation is immediate and permanent: the key stops authenticating right away, and there’s no way to restore it. Anything that was using it (a script, a CI job, an MCP client) will need a new key.
Creating and revoking a key are both recorded in your forum’s audit log, along with every action a key performs while it’s active, attributed to the key itself rather than to whoever created it.
How many keys can I have?
Section titled “How many keys can I have?”API keys are not a per-plan limit: every forum, on any plan, can create as many as it realistically needs. There’s a generous ceiling that exists only to stop abuse, not to gate a feature. If you ever reach it, revoke a key you no longer use, or get in touch if you have a genuine need for more.