API keys
Expiry, networks, rotation, notices and the record of calls a company keeps for each key.
Company owners and admins manage keys in Works Studio, under Settings → API keys. This page explains the rules those keys follow.
Limits on keys
- A key expires at most 365 days after it is created. Pick the shortest expiry the integration can live with.
- A company can have 10 active keys at once.
- Creating a key needs two-step sign-in on the creator's account and a sign-in within the last 15 minutes.
Networks
A key can be limited to networks: IP addresses or ranges, separated by commas, up to 20 of them. A call from anywhere else answers ip_not_allowed and does not count against the rate limits. Leave the networks empty to allow any network.
Whether or not a key is limited, Kapi notes the networks each key is used from. The first network is expected; when a key is later used from a new one, the company's owners and admins are told.
Rotate a key
- Create a replacement key with the same scopes.
- Update the receiving server with the new key.
- Confirm a successful call with it.
- Revoke the old key.
Revocation takes effect on the next call.
Notices
Owners and admins of the company receive an email when:
- a key is created;
- a key expires in 30 days, and again in 7 days;
- a revoked or expired key is used, at most once a key each day;
- a key is sent in a web address, which revokes it;
- a key is used from a new network.
These notices are separate from training reminders, and they contain no key.
Calls you can review
The API keys page in Works Studio lists the company's recent calls with their key, register, status, rows, time taken and request ID. The request ID is the X-Request-Id the call returned. Kapi keeps call records for 13 months.
Before you switch an integration on
Build against the sandbox company first. Then test with a company that has authorised you: scoped access, every page of each register, missing training, completions, expired certificates, retries and revocation. Keep data from different companies apart. There is no public demo key and no self-service sign-up: Kapi gives sandbox keys to partner engineers on request.