Everywhere you are
API keys and scopes
An API key authenticates a script or an integration as you.
Creating one
Settings Advanced API Keys creates and manages keys. Copy it when it is shown, since it is not displayed again.
The scopes
| Scope | Allows |
|---|---|
read:lists | Reading lists |
write:lists | Creating and changing lists |
read:things | Reading things |
write:things | Creating and changing things |
search | Searching |
Grant the narrowest set that works. A dashboard that only displays should get read scopes and nothing else, so a leaked key cannot delete anything.
Keeping it safe
Rate limits
1000 requests an hour, per key. Separate keys for separate tools means one noisy script does not starve another.
Revoking
Delete the key in settings. Anything using it stops working at once, which is the point.
Tips
- One key per tool, named after the tool. Then revoking one thing does not break everything.
- Read-only wherever possible. Most integrations need far less access than people grant them.