API Secrets

Your account can now have several API Secrets, each with its own name. That way each integration gets its own secret, and you can revoke one whenever you want without affecting the others. For security, each secret is shown only once, right when you create it.

1. Where to find it

Go to Settings → Account → API. This section now has two tabs:

• Configuration: enabling the API, the webhook URL, and which webhooks are sent. Nothing changes here.
• API Secrets: your account's list of secrets, where you can create and delete them.

Only users with permission to manage the account can see this section.

The old "API Secret" field in the Configuration tab is gone. The secret can no longer be viewed again in the app.

2. The list of secrets

The API Secrets tab shows one card per secret, with:

• Its name.
• When it was created (for example, "Created 15 days ago").
• A button to delete it.

If your account already had an API Secret, you'll find it in the list under the name Default. The integrations that used it keep working, with nothing for you to do.

3. Create a new secret

1. Click Create API Secret.
2. Type a name that helps you recognize what it's for (for example, "CRM integration").
3. Click Create API Secret.

You'll then see the full secret, with a button to copy it.

Copy it right away. The secret won't be shown again. While it's on screen, the window only closes with the Close button, so you can't close it by accident. If you lose it, create a new one and delete the old one.

Once you close the window, the new secret appears in the list with the others.

4. Delete a secret

1. Click the delete (trash) button on the secret's card.
2. Confirm in the window that appears.

When you delete a secret, the integrations using it stop working immediately. Before deleting it, make sure no active integration depends on it.

Conclusion

Having one secret per integration gives you better control over who can access your account through the API. You can revoke a single integration's access without touching the others, and because secrets can't be viewed again, they're less likely to end up in the wrong hands.

Relevant scenarios

• Several connected tools: use a different secret for your CRM, your automation tool, and your website. If you stop using one, delete only its secret.
• A new provider or a new person in charge: create a new secret for whoever takes over, update the integration, and delete the old one.
• You suspect a secret has leaked: create a new one, swap it into the affected integration, and delete the compromised one.