How to get a key and how to send it.
Every request is authenticated with an API key. Each key belongs to the user who creates it and is tied to that person’s seat. Store your key like a password, and we recommend creating keys from a dedicated integration account rather than a personal login. That way your integration doesn’t depend on any one person’s access.
Create an API key
- Sign in to the Community dashboard using a role with API permissions.
- Go to Settings > API Tokens.
- Click Generate New Token and give it a name that describes the integration, like “Salesforce sync” or “Checkout signups.”
- Click Continue.
- Copy the key and store it somewhere secure, like a secrets manager or environment variable. NOTE: You won’t be able to see it again after you close this window.
To confirm it works, call GET /members?limit=1 with your key. A 200 means you’re set.
Send your API key as a bearer token on every request.
curl https://api.community.com/members \
-H "Authorization: Bearer $COMMUNITY_API_KEY"Keys are created in the dashboard and belong to the client rather than to the
person who created them, so an integration keeps working when that person
leaves.
What a key can do
A key carries capabilities. A call the key is not scoped for is refused rather
than silently returning nothing, so a 403 means the credential is valid but
not permitted, never that the object does not exist.
Rotation
A key expires after 12 months without use. Every call with the key starts the
12 months again, so a key in regular use does not expire. Rotate keys on your
own schedule, and delete a key that you no longer use.