API Keys and Developers

API Keys and Developers

The Developers surface holds the public API reference and the credentials for reaching Quickly programmatically. It is restricted to Owners and Admins, because an API key is workspace access in a string.

Who can use it: Owner, Admin · Availability: Core surface

Keys Are Scoped

A key is created with a name, a set of scopes, and an optional expiry. Scopes are grouped by the area they cover, including playbooks, agents, integrations, custom integrations, knowledge, messages and logs, webhooks, and web access. Each group separates read from write, so a key that only needs to list playbook runs never needs permission to change them.

Grant the minimum the consuming system needs. A reporting script wants read scopes and nothing else; giving it write access costs nothing today and everything on the day it is compromised.

Expiry and Rotation

Setting an expiry turns key rotation from a task somebody has to remember into something the system enforces. When you rotate, create the replacement first, move the consumer over, confirm it is working, and only then revoke the old key. Revoking first guarantees an outage.

Keys are shown once at creation. If a key is lost, it cannot be recovered, only replaced.

What the API Covers

The REST API exposes agents, playbooks and their runs, task logs, knowledge, and messages, with rate limit headers on every response. The full endpoint reference is on the API reference page.

How to create an API key

1. Open Settings and navigate to API Keys.
2. Click Create Key with the minimum scopes needed.
3. Store the generated key securely because it will not be shown again.

How to test an endpoint

1. Open Developers in the sidebar and select the API Reference tab.
2. Copy an example request and add your API key as authorization.
3. Confirm the response shape before wiring it into production code.

How to rotate a key

1. Open Settings and click Create Key for a replacement.
2. Update the consuming system.
3. Click Revoke on the old key after traffic has moved.

Good to Know

• API keys should be scoped to the minimum permissions needed by the consuming system.

Related

• MCP Server for connecting external AI clients rather than writing HTTP calls.
• Activity Logs for auditing what an API-driven integration did.
• Team Settings for the roles that can reach this surface.