What this screen is for
The top panel gathers the values integrators keep asking for: your company slug, the sending endpoint, and, expandable below, the approved messaging identifiers grouped under the sender they belong to. Everything is copyable. Below that you create and manage the API keys themselves, and a link opens the public API documentation in a new tab.
Why it matters
An API key grants access to this company data from outside the app, so treat one like a password: create a separate key per integration, and remove a key as soon as the integration using it is retired. The company slug is the value most often got wrong; it is the subdomain, not your trading name.
What you see on this screen
An Integration details panel opens the page, described as what to share with whoever is building against the API - everything except the secret. It holds Company slug and SMS endpoint, both with a copy button, and a note that requests authenticate with X-Client-Id and X-Client-Secret headers. Show SMS / DLT identifiers expands the approved sender headers and, under each, the approved templates with their identifier, variable count, maximum length and content, each copyable.
The key table has seven columns: Name (with the permissions granted listed underneath), Client ID, Status, Rate Limit, Expires, Last Used and Actions.
Creating a key asks for Name (required), Allowed Domains (a comma-separated list; leave it empty to allow any), the Permissions to grant, a Rate Limit (per min) and an Expires At date. Permissions are grouped as Recruitment, Leads, Invoicing, Orders, Customers and Products, and Messaging, and are granted individually - view or create and edit for each kind of record, and send for SMS, WhatsApp and email.
When a key is created the Client ID and Client Secret are shown once, with the warning that the secret will not be shown again.
Filters and actions
There are no filters. Create API Key makes one. Regenerate issues a new ID and secret and stops the old credentials working immediately, breaking anything still using them. Delete removes the key entirely. API Docs opens the public reference.
Status values
Active - the key works. Inactive - the key is rejected. Expires and Last Used read Never where no date applies.
Related
- Third Party Integrations - ready-made connections that need no key
- Webhooks - the inbound direction
- Sender IDs / Headers - the approved senders listed in this panel