API keys used to be a list in Settings → Security, and that was all there was. You could mint a key and revoke it. What the key then did was invisible: whether a call arrived, what it answered, how close you were to the daily limit.

The API is now a connector in the Integrations marketplace, with three tabs.

Settings — your keys

Mint a key, name it, choose what it may do, rotate it, revoke it. The secret is shown once, at creation, and never again — so the copy button on that dialog is the only chance to take it.

Activity — every request

A log of the calls your keys made: the endpoint, the method, the status code, how long it took and which key made it. This is the tab to open when an integration "isn't working" — a call that never arrives looks completely different from one that arrives and gets a 403, and until now both looked the same from here.

Usage — what your plan allows

Requests made today against the daily allowance for your plan, so a limit you are about to hit is something you can see coming.

Disconnecting is reversible

Disconnecting the connector suspends every key at once, which is the fast answer if you think one has leaked. Reconnecting brings the same keys back — you are not re-issuing credentials to whoever was using them. To retire a key for good, revoke it.

API access is available on Starter, Pro and Business. The reference is at /developers.