Workspace Settings: API Access Keys

Overview

API access keys are unique codes that act like passwords, allowing authorized applications and users to securely interact with Sona's API. This guide walks you through creating, managing, and deleting access keys from the Access Keys page in Workspace Settings, so you can generate and manage separate keys for each integration and keep API access across your team secure and organized.

When to use API Access Keys

Use API access keys when you need to:

Connect Sona with external tools and platforms.
Set up integrations for dashboards, CRM systems, or marketing automation.
Provide API access to different team members or applications.
Organize and track API usage by purpose, for example separate keys for development versus production.

Prerequisites:

Admin access to Workspace Settings.
An understanding of which integration or application needs API access.

Getting to Access Keys

Access Keys lives under Workspace Settings in the left sidebar. To open it:

In the left sidebar, click Workspace Settings. If the sidebar is collapsed to icons, click the toggle at the top of the sidebar to expand it, or hover over an icon to see its label.
Click Access Keys.

Step 1: create a new access key

Click Create New in the top-right corner. A Create new Access Key window opens.

If an Organization dropdown appears, choose the organization the key is for.
In Key Name, enter a descriptive name that identifies the key's purpose, for example "Account Enrichment API Key," "CRM Integration Key," or "Marketing Automation Key." Clear names make the keys easier to manage later.
Click Confirm. Your new access key is generated and added to the list. Click Cancel instead to close the window without creating a key.

Save your key securely: click Copy next to the new key and store it in a secure location, such as a password manager or secure vault. Your API access is now set up and ready to use.

Step 2: view and manage existing keys

The Access Keys page lists your keys in a table with the following columns:

Key: the access key itself, with a Copy button to copy it to your clipboard.
Name: the descriptive name you assigned.
Organization: the organization the key belongs to.

Use these controls to find and organize keys:

Search name: type part of a key's name and click Search to narrow the list.
Refresh: reloads the list to show the latest keys.
Sorting: click the arrows next to a column name to sort by that column.
Show rows, Previous, and Next: choose how many keys to show per page and move between pages.

Step 3: delete an access key

Locate the key to delete: find the access key you want to remove in the table, then click the trash icon (🗑️) on the right side of the row.

Confirm deletion: a confirmation dialog will appear asking "Are you sure you want to delete the '[Key Name]'?". Click Confirm to permanently delete the key, or click Cancel if you want to keep it.

Note: Any integration still using a deleted key stops working with Sona's API. Create a replacement key and update the integration before you delete the old one.

Key concepts and best practices

Organization and security:

Create separate access keys for different purposes, for example data enrichment or analytics.
Use descriptive, meaningful names that clearly identify each key's purpose.
Regularly audit your access keys and delete unused ones.
Never commit access keys to code repositories or share them publicly.

Key management:

Document which applications or team members are using each key.
Rotate keys periodically for enhanced security.
If you suspect a key has been compromised, delete it immediately and create a new one.
Keep a secure backup of active keys in your organization's password management system.

FAQs

What is an API access key used for?

An API access key acts like a password that lets authorized applications and users securely interact with Sona's API. You create separate keys for different integrations, such as a CRM connection or marketing automation tool, so access can be managed and audited independently for each one.

What happens if I lose my access key after creating it?

Find the key in the Access Keys table and click Copy next to it. If you think the key may have been exposed, delete it and create a new one instead, then store the replacement securely in a password manager or vault.

What should I do if I suspect a key has been compromised?

Delete the compromised key immediately from the Access Keys table, then create a new one for the same integration. Regularly auditing your keys and never committing them to code repositories helps prevent this situation in the first place.

How do I find a specific key quickly?

Type part of the key's name in Search name and click Search. You can also sort the table by Name using the arrows next to the column name.