Improved
Give each API key only the permissions it needs
When you create an API key, pick a preset or choose each permission yourself — and see on every key what it can reach and who created it.
An API key used to come from a short list of presets, and nothing on screen said what a preset allowed. An integration that only needed to read contacts had to take a whole bundle of other permissions with it.
Two ways to create a key
- Preset — for "read only" or "full access" and nothing more to decide.
- Choose permissions — every permission, grouped by what it touches (contacts, messages, templates and so on), each with a short description.
Know a key before you revoke it
Each key in the list now shows its permissions (or one Full access badge) and when it was created, and by whom. That answers the two questions to ask before you revoke a key: what can it reach, and whose integration will stop?
API keys live under Integrations → Public API. The API documentation lists every permission.