Manage API Keys
Overview
API Keys let external systems (such as CRMs, marketing tools, or other integrations) access your PodPlay data in a secure way. Each key is tied to a user whose permissions it inherits. You can create keys, turn them on or off, and choose whether a key can only read data or can also create, update, and delete it.
Use API Keys when you need to connect a third-party tool to PodPlay (for example to receive webhooks or to look up events and bookings). Each key is assigned to a user—often an admin—whose permissions the key uses, so you control what the integration can do.
Cost by Tier
Depending on the Club's Tier, API keys can be created and provided to Club Owners/GMs:
Basic(+) tiers — $100/month to generate one or many API keys
Pro or Autonomous(+) tier — free to generate API keys
Ask for API Keys
The Customer Success team can share API keys with you upon request if you are paying for them or are on the Pro/Auto(+) tier.
Viewing the API Keys list
The API Keys page shows a table of all keys for your company:
Name – The display name you gave the key. If the key is read-only, a Read only tag appears next to the name (hover over it to see an explanation).
User – The user whose permissions the key uses. Click the name to open that Customer’s profile.
Status – Active or Inactive. Inactive keys cannot be used.
Use the filters at the top to narrow the list:
Search by display name – Type part of a key’s name.
Filter by status – Choose Active and/or Inactive.
Filter by read only – Choose All API keys, Read only keys, or Not read only keys.
Creating an API Key
On the API Keys page, click Create API Key.
In the API Key Details panel, fill in:
Display Name – A name that helps you identify this key (for example, "CRM Integration" or "Marketing Tool").
User – Select the user whose permissions the key will have. The key will inherit that user’s access rights.
Read only – Turn this on if the key should only be allowed to read data (events, bookings, etc.) and not create, update, or delete anything. Read-only keys are limited to safe HTTP methods (GET, HEAD, OPTIONS, TRACE). Use this for tools that only need to receive webhooks or look up information.
Status – Active or Inactive. New keys are usually set to Active.
Click Save (or the equivalent save action in the drawer).
After saving, the key’s secret (token) is shown once. Copy and store it securely; you will not be able to see it again. If you lose it, you will need to create a new key.
Editing an API Key
On the API Keys page, click the name of the key you want to edit.
The same API Key Details panel opens. You can change Display Name, Read only, and Status. The User is shown as a link to that Customer’s profile.
Save your changes.
You cannot change the key’s secret after creation. To get a new secret, create a new API Key.
Read-only Keys
When Read only is enabled for an API Key:
The key can read data (for example events, reservations, memberships) according to the permissions of the user it is tied to.
The key is limited to safe, non-mutating HTTP methods: GET, HEAD, OPTIONS, and TRACE.
The key cannot create, update, or delete any resources (requests that use methods like POST, PUT, PATCH, or DELETE will be blocked).
This is useful for integrations that only need to:
Receive outbound webhooks from PodPlay.
Look up information (events, bookings, customers) without changing anything.
Use a non–read-only key only when the integration must create or update data (for example creating bookings or updating records). Prefer read-only keys when the tool does not need to make changes.
API usage visibility for read-only traffic
If your team needs better visibility into how integrations are reading data, PodPlay can enable an additional Audit Log option for your company.
Go to Company Settings -> General -> Security.
Turn on Audit Log first.
Then enable Audit: API key GET metadata (analytics).
When this option is enabled, PodPlay keeps lightweight usage metadata for read-only API key traffic to help with integration reporting. This does not change customer-facing behavior in the app.
PLEASE NOTE: This option is managed for PodPlay admin access levels and may not be visible to every staff role.
Tips
Give each key a clear Display Name so you can tell them apart (e.g. "CRM – Read only", "Marketing – Full access").
Use Read only for as many keys as possible to limit what can be changed if a key is ever exposed.
Set keys to Inactive when you stop using an integration, instead of deleting them, so you can audit past usage.
Last updated
Was this helpful?