API Keys

API keys authenticate server-to-server requests to the FormWork REST API. Each key belongs to one account and acts as the user who created it.

Create a key

1. Open Account Settings.
2. In API Keys, select Create New API Key.
3. Give it a descriptive name, such as Production CRM sync.
4. Select Create Key.
5. Copy the displayed key immediately.

The full key is shown once and cannot be retrieved later. Treat the complete value as a password.

Authenticate a request

Send the key as a Bearer token and specify the account in X-Account-ID where required by the endpoint:

curl "https://app.useformwork.com/api/v1/projects" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Account-ID: YOUR_ACCOUNT_ID"

The account header must match the key’s account. A mismatched account returns a forbidden response.

Scope and permissions

Keys are account-scoped; there is no per-key permission selector. A valid key uses the creating user’s identity and account role when an endpoint performs a role check. For example, a key created by a Standard user cannot bypass the Admin-only form deletion rule.

API keys are not used for a respondent’s private entry session. Client entry endpoints use an entry access key in X-Formwork-Entry-Key; see the API Reference.

What the key list shows

Account Settings displays:

• Name
• Creation date
• Last-used date, or Never
• Active or Revoked status

It does not display a partial secret. Keep your own inventory of which system holds each named key.

Revoke a key

Select Revoke and confirm. Revocation is immediate and cannot be undone. Requests with the old value return an authentication error; create and deploy a replacement before revoking if the integration must remain online.

Safe key management

• Put keys in your application’s protected secret store.
• Never commit them to source control, browser code, screenshots, or support tickets.
• Use one key per application and environment so each can be revoked independently.
• Name keys after their owner and purpose.
• Review Last Used and revoke retired integrations.
• Rotate a key by creating a new one, updating the consumer, verifying it, then revoking the old one.

FormWork does not currently publish fixed request-per-minute limits. If the API returns 429, pause and retry using the guidance in the response rather than relying on previously published figures.

For routes and schemas, open the API Reference.