Overview
API access keys are unique codes that act like passwords, allowing authorized applications and users to securely interact with Sona's API. This guide walks you through creating, managing, and deleting access keys in your Workspace Settings. With this guide, you will be ready to confidently generate and manage keys for different integrations, ensuring secure and organized API access across your team.
When to use API Access Keys
Use API access keys when you need to:
Connect Sona with external tools and platforms.
Set up integrations for dashboards, CRM systems, or marketing automation.
Provide API access to different team members or applications.
Organize and track API usage by purpose, for example separate keys for development versus production.
Prerequisites:
Admin access to Workspace Settings.
An understanding of which integration or application needs API access.
Step 1: create a new access key
Navigate to Access Key settings: from the left sidebar, click Workspace Settings, then select Access Key from the menu.
Initiate API key creation: click the + Create New button in the top-right corner. A modal will appear titled "Create new API Access Key".
Name your access key: in the Key Name field, enter a descriptive name that identifies the key's purpose, for example "Account Enrichment API Key," "CRM Integration Secret," or "Marketing Automation Key." Choose names that clearly indicate what the key is used for, since this makes management easier later.
Generate the key: click the Confirm button. Your new access key will be generated and added to the list.
Important: copy your access key immediately after creation. For security reasons, you will not be able to view the full key again.
Save your key securely: store the key in a secure location, such as a password manager or secure vault. Your API access is now set up and ready to use.
Step 2: view and manage existing keys
The Access Keys page displays all of your current keys in a table format with the following information:
Key: the unique identifier, truncated for security.
Name: the descriptive name you assigned.
Created at: the date and time of creation.
Step 3: delete an access key
Locate the key to delete: find the access key you want to remove in the table, then click the trash icon (🗑️) on the right side of the row.
Confirm deletion: a confirmation dialog will appear asking "Are you sure you want to delete the '[Key Name]'?". Click Confirm to permanently delete the key, or click Cancel if you want to keep it.
You now have full control over your API access management.
Key concepts and best practices
Organization and security:
Create separate access keys for different purposes, for example data enrichment or analytics.
Use descriptive, meaningful names that clearly identify each key's purpose.
Regularly audit your access keys and delete unused ones.
Never commit access keys to code repositories or share them publicly.
Key management:
Document which applications or team members are using each key.
Rotate keys periodically for enhanced security.
If you suspect a key has been compromised, delete it immediately and create a new one.
Keep a secure backup of active keys in your organization's password management system.
FAQs
What is an API access key used for?
What is an API access key used for?
An API access key acts like a password that lets authorized applications and users securely interact with Sona's API. You create separate keys for different integrations, such as a CRM connection or marketing automation tool, so access can be managed and audited independently for each one.
What happens if I lose my access key after creating it?
What happens if I lose my access key after creating it?
For security reasons, Sona only shows the full key once, immediately after creation. If you lose it, you cannot view it again; delete the key from the Access Keys table and create a new one, then store the replacement securely in a password manager or vault.
What should I do if I suspect a key has been compromised?
What should I do if I suspect a key has been compromised?
Delete the compromised key immediately from the Access Keys table, then create a new one for the same integration. Regularly auditing your keys and never committing them to code repositories helps prevent this situation in the first place.