API keys

Each key belongs to one project and is created in Settings, API keys. The secret is shown once, when the key is created. Store it in your secret manager; it cannot be retrieved later.

Scopes

Every key starts with crm_ and has one of three scopes:

Scope	What it can do
Read only	Read the organization and the project it belongs to.
Read and write	Read them, and change the project's settings, such as its name and currency.
Send data only	Send usage data and custom source files to the project, and nothing else: it cannot read anything.

No key can manage people, single sign on or other keys, and none can reach another project. A key that leaked reaches no further than its project and scope. Use a Send data only key in your own services, since it can never read your billing data; see Sending usage data and Custom sources.

Using a key

Send it as a bearer token:

Authorization: Bearer crm_...

Expiry and revocation

Choose an expiry of 30 days, 90 days, a year, or none. Revoking a key stops everything using it straight away. Each key shows when it was last used, which helps find keys that can be retired.