Managing API Access Keys

API access keys let you authenticate with Harmony's external API so you can build integrations, automate workflows, and connect third-party tools to your account without manual intervention. Instead of using your personal credentials, you generate a dedicated key that external systems use to identify and authorize their requests.

This article explains how to create, view, and manage your API access keys.

---

How API Access Keys Work

Each access key acts as a credential that grants programmatic access to your Harmony account and data. When an external system - such as a custom integration or an automation tool - makes a request to the Harmony API, it includes the access key to prove it is authorized to do so.

Because access keys are separate from your personal login credentials, you can:

• Revoke a key at any time without affecting your account password or other keys.
• Create multiple keys for different integrations or use cases.
• Limit the blast radius of a compromised key by rotating or deleting it independently.

---

Creating an API Access Key

1. Navigate to Settings in the main navigation.
2. Select the API Access Keys section.
3. Click Create Access Key (or New Key, depending on your account view).
4. Give the key a descriptive name so you can identify its purpose later - for example, Zapier Integration or Data Export Script.
5. Click Create.
6. Copy the key value that appears on screen. This is the only time the full key is displayed. Store it somewhere secure, such as a password manager or secrets vault, before closing the dialog.

Important: Once you close the creation dialog, the full key value cannot be retrieved again. If you lose it, you will need to delete the key and create a new one.

---

Viewing Your Access Keys

All existing access keys are listed in Settings > API Access Keys. For each key you can see:

• The key name you assigned.
• The date it was created.
• The date it was last used (if available).

The full key value is never shown again after creation, so only the metadata above is visible in the list.

---

Deleting an Access Key

When you no longer need a key - or if you suspect it has been compromised - delete it immediately.

1. Go to Settings > API Access Keys.
2. Locate the key you want to remove.
3. Click the Delete (or trash icon) button next to it.
4. Confirm the deletion when prompted.

Once deleted, any system still using that key will receive authentication errors. Update or remove the key from all external tools before or shortly after deleting it.

---

Best Practices

• Use one key per integration. This makes it easy to revoke access for a single tool without disrupting others.
• Rotate keys periodically. Create a new key, update your integration, then delete the old key on a regular schedule.
• Never commit keys to source code. Store them in environment variables or a secrets management service.
• Delete unused keys. If an integration is decommissioned, remove its key right away to reduce unnecessary access.

---

Next Steps

Once you have an access key, refer to the Harmony API documentation for details on how to include it in your requests, the available endpoints, and the data you can read or write programmatically.