Skip to main content
You create and manage API keys in Settings → API in the Secfix app. There is no API for it. Each API key belongs to one workspace, has one access level, and has one active token at a time. It has a client ID and a client secret that you use to get tokens.

​
Create an API key

1

Open Settings → API

In the Secfix app, go to Settings → API. You need permission to manage API keys in your workspace.
2

Create the API key

Give it a name and choose its access level. Grant only what the integration needs, such as Read for a read-only inventory sync. You can grant only an access level your own role covers for all data. See Who can grant an access level.
3

Copy the client secret

You get a client_id and a client_secret. The secret is shown once and never again. Store it in your secrets manager right away. You can rotate it later.

​
Access levels

Each API key has one of three access levels. Each level grants scopes: all:read grants read access to every resource. all:write grants write access to every resource. See Scopes. If you edit an API key and remove a scope, its current access token stops working and returns 401 token_superseded. Get a new token, which has the new access level.

​
Rotate the secret

Rotating the secret gives you a new client_secret. The current access token stops working at once and returns 401 token_superseded, because an API key has only one active token. Get a new token with the new secret. See Authentication.

​
Delete an API key

Deleting an API key permanently revokes its credentials and its active token. Requests with that token then return 401 token_superseded.