API keys

Back to the guide

Settings → API keys

Keys let other software read and update your CRM. Owners and admins can create, rotate and revoke them.

A key looks like sf_live_… and is sent as a bearer token. It is shown once, when created. Store it somewhere safe; if you lose it, rotate rather than hunt for it.

What a key can do

Each key holds a list of scopes — read or write on objects, records, notes, lists and tasks — and each scope can be narrowed to particular objects.

Three rules govern this, and they matter:

A key can only be given scopes its creator holds. An admin cannot create a key more capable than an admin.

A key is never an owner. It never inherits the owner exemption from restricted records.

Scopes and visibility are separate checks, and both must pass. A scope permits an action; it does not reveal anything. What a key can see is decided by the same record-level permissions as a person, through the key's own service account. So a restricted record stays invisible to a key until somebody grants that key access under Settings → Access and permissions.

Something outside a key's reach returns not found, the same as something that does not exist. That is deliberate — a different answer would confirm the record exists.

Deliberately not available to keys

Team and invitations, access grants, API key management, billing, email accounts and message bodies, admin, cron and webhooks.

If you need one of those, it is a gap to be filled deliberately, not an oversight.

Rotating and revoking

Rotate issues a new secret for the same key, with the same scopes. Use it when a key may have leaked, or on a schedule.

Revoke ends it. Anything using it stops immediately.

Usage

Each key has its own request log, so you can see what it has been doing and when it was last used. Worth checking before revoking something you think is unused, and worth checking afterwards to see what broke.

Responses

Every response carries a request id, and rate limit headers showing your limit, what remains, and when it resets. A rate-limited response also says how long to wait.

Errors come back with a code, a message and that request id, which is the thing to quote when asking about a failed call.

Lists are paged with a cursor rather than page numbers.

API keys against connected apps

Both reach the same data; they differ in who they act as.

Use a key for software that runs on its own — a script, a sync job, a tool such as Claude Code. Use a connected app for something a person drives.

See Connected apps.

Next

• Public pages