You will have made a key an outside program can use, limited to what it needs.
Before you start
You need the API Keys Manage permission, and creating keys must be in your plan. Know which permissions the integration needs (for a lead-capture form, usually only crm.leads.write). You can give a key only permissions you hold yourself.
Steps
- Open API Keys and press New key.
- Enter a name that says what will use it, for example "Website lead form" (up to 100 characters).
- Tick the scopes. Tick only what the integration needs. At least one is required.
- Pick an expiry date if the integration is temporary or you want to force regular renewal. It cannot be changed later.
- Press Create.
- Copy the key from the dialog and store it where the integration can read it, such as a secrets manager.
- Press Done.
What you will see
The key appears in the list as Active, with its prefix and scopes, and "Never" under last used. The full key was shown only once.
If something goes wrong
- If you did not copy the key, it cannot be recovered. Revoke it and create a new one.
- Create stays disabled until a scope is ticked; a lock banner means your plan does not include creating keys.
- You cannot see a permission you do not hold, and platform-operation permissions are hidden unless you are a superadmin.
- Give each integration its own key, so you can revoke one without breaking the others.