# API Keys

Canonical: https://useformwork.com/docs/platform/api-keys

Create, use, audit, and revoke account-scoped API keys.

API keys authenticate server-to-server requests to the FormWork REST API. Each key belongs to one account and acts as the user who created it.

## Create a key

1. Open **Account Settings**.
2. In **API Keys**, select **Create New API Key**.
3. Give it a descriptive name, such as **Production CRM sync**.
4. Select **Create Key**.
5. Copy the displayed key immediately.

The full key is shown once and cannot be retrieved later. Treat the complete value as a password.

## Authenticate a request

Send the key as a Bearer token and specify the account in `X-Account-ID` where required by the endpoint:

```bash
curl "https://app.useformwork.com/api/v1/projects" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Account-ID: YOUR_ACCOUNT_ID"
```

The account header must match the key's account. A mismatched account returns a forbidden response.

## Scope and permissions

Keys are account-scoped; there is no per-key permission selector. A valid key uses the creating user's identity and account role when an endpoint performs a role check. For example, a key created by a Standard user cannot bypass the Admin-only form deletion rule.

API keys are not used for a respondent's private entry session. Client entry endpoints use an entry access key in `X-Formwork-Entry-Key`; see the [API Reference](/docs/api/reference).

## What the key list shows

Account Settings displays:

- Name
- Creation date
- Last-used date, or **Never**
- **Active** or **Revoked** status

It does not display a partial secret. Keep your own inventory of which system holds each named key.

## Revoke a key

Select **Revoke** and confirm. Revocation is immediate and cannot be undone. Requests with the old value return an authentication error; create and deploy a replacement before revoking if the integration must remain online.

## Safe key management

- Put keys in your application's protected secret store.
- Never commit them to source control, browser code, screenshots, or support tickets.
- Use one key per application and environment so each can be revoked independently.
- Name keys after their owner and purpose.
- Review **Last Used** and revoke retired integrations.
- Rotate a key by creating a new one, updating the consumer, verifying it, then revoking the old one.

FormWork does not currently publish fixed request-per-minute limits. If the API returns `429`, pause and retry using the guidance in the response rather than relying on previously published figures.

For routes and schemas, open the [API Reference](/docs/api/reference).