API keys

An API key lets a script or another tool use the REST API on behalf of your workspace.

A key belongs to the workspace, not to the person who made it. It keeps working when people leave, and what it does shows as API · name in comments, activity and the audit log. A key is not a member: it never shows in member lists or pickers and does not take a seat.

Create a key

1. Go to Settings → Integrations → REST API and click New key. You need the Connect integrations and rules permission.
2. Give it a name that says where it is used, such as “n8n” or “Reports”.
3. Choose a role. The key may do what the role may, and never more than you may yourself. Use a role with few permissions when the key only needs a little.
4. Choose the access:
   • Read only: can fetch projects, items and comments but not change anything.
   • Read and write: can also create and change items and comment, within the role’s permissions.
5. Choose Projects: All projects the role can see, or Only selected. A key limited to some projects sees nothing else.
6. Choose when it expires: in 30, 90 or 365 days, or never. 90 days is the default. An expired key stops working on its own.
7. Click Create key and copy the key now. It is shown only once; keep it in a password manager.

Use it

Send the key in the Authorization header:

curl https://work.nod3.se/api/v1/items?project=WEB \
  -H "Authorization: Bearer w3_..."

Each key may make 120 requests per minute.

Revoke a key

Click Revoke next to the key. Anything using it stops working at once. Its name still shows on what it did. Creating and revoking keys shows in the audit log.

A role that a key uses cannot be deleted until the key is revoked.

Personal API keys

A workspace can also let people make personal API keys under Settings → My integrations → My API keys. A personal key is different from the keys above:

• It acts as you: your role, your permissions and only what you may see. What it does shows under your name. If your role changes, so does what the key may do, and it stops working if you leave the workspace.
• There is no role to pick. You choose a name, Read only or Read and write, All projects or Only selected (among the projects you can see), and an end date of 30, 90 or 365 days. A personal key always ends. Limit a key to the projects a script needs: it then sees and changes nothing else, even where you could.
• You can have at most 10 at a time in each workspace. It is shown once, like other keys.

Personal API keys are off until someone with the Connect integrations and rules permission turns them on for some roles under Settings → Integrations → Rules (see Who sees which settings). If they are turned off again, existing personal keys stop working at once and work again when turned back on. Admins see who has personal keys, and when they were last used, under Connected by people, and can revoke them there. The key itself is never shown again.