> For the complete documentation index, see [llms.txt](https://docs.podplay.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podplay.app/owners-playbook/build-your-club/company-settings/manage-api-keys.md). # Manage API Keys API Keys let external systems (such as CRMs, marketing tools, or other integrations) access your PodPlay data in a secure way. Each key is tied to a user whose permissions it inherits. You can create keys, turn them on or off, and choose whether a key can only **read** data or can also create, update, and delete it. Use API Keys when you need to connect a third-party tool to PodPlay (for example to receive webhooks or to look up events and bookings). Each key is assigned to a user—often an admin—whose permissions the key uses, so you control what the integration can do. *** ## Where to find API Keys * Open **Company Settings** (or your company/tenant settings in the Dashboard). * Go to the **Api Keys** section or use the **Api Keys** item in the app menu. * You must have the appropriate admin role to see and manage API Keys. \[SCREENSHOT NEEDED: Navigation to Api Keys page or menu item] *** ## Viewing the API Keys list The API Keys page shows a table of all keys for your company: * **Name** – The display name you gave the key. If the key is read-only, a **Read only** tag appears next to the name (hover over it to see an explanation). * **User** – The user whose permissions the key uses. Click the name to open that Customer’s profile. * **Status** – **Active** or **Inactive**. Inactive keys cannot be used. Use the filters at the top to narrow the list: * **Search by display name** – Type part of a key’s name. * **Filter by status** – Choose Active and/or Inactive. * **Filter by read only** – Choose **All API keys**, **Read only keys**, or **Not read only keys**. \[SCREENSHOT NEEDED: API Keys table with filters and at least one key showing the Read only tag] *** ## Creating an API Key * On the API Keys page, click **Create API Key**. * In the **API Key Details** panel, fill in: * **Display Name** – A name that helps you identify this key (for example, "CRM Integration" or "Marketing Tool"). * **User** – Select the user whose permissions the key will have. The key will inherit that user’s access rights. * **Read only** – Turn this **on** if the key should only be allowed to read data (events, bookings, etc.) and **not** create, update, or delete anything. Read-only keys are limited to safe HTTP methods (GET, HEAD, OPTIONS, TRACE). Use this for tools that only need to receive webhooks or look up information. * **Status** – **Active** or **Inactive**. New keys are usually set to Active. * Click **Save** (or the equivalent save action in the drawer). After saving, the key’s secret (token) is shown once. Copy and store it securely; you will not be able to see it again. If you lose it, you will need to create a new key. \[SCREENSHOT NEEDED: Create API Key drawer with Display Name, User, Read only switch, and Status] *** ## Editing an API Key * On the API Keys page, click the **name** of the key you want to edit. * The same **API Key Details** panel opens. You can change **Display Name**, **Read only**, and **Status**. The **User** is shown as a link to that Customer’s profile. * Save your changes. You cannot change the key’s secret after creation. To get a new secret, create a new API Key. *** ## Read only keys When **Read only** is enabled for an API Key: * The key can **read** data (for example events, reservations, memberships) according to the permissions of the user it is tied to. * The key is limited to safe, non-mutating HTTP methods: **GET**, **HEAD**, **OPTIONS**, and **TRACE**. * The key **cannot** create, update, or delete any resources (requests that use methods like POST, PUT, PATCH, or DELETE will be blocked). This is useful for integrations that only need to: * Receive outbound webhooks from PodPlay. * Look up information (events, bookings, customers) without changing anything. Use a **non–read-only** key only when the integration must create or update data (for example creating bookings or updating records). Prefer read-only keys when the tool does not need to make changes. *** ## API usage visibility for read-only traffic If your team needs better visibility into how integrations are reading data, PodPlay can enable an additional Audit Log option for your company. * Go to **Company Settings** -> **General** -> **Security**. * Turn on **Audit Log** first. * Then enable **Audit: API key GET metadata (analytics)**. When this option is enabled, PodPlay keeps lightweight usage metadata for read-only API key traffic to help with integration reporting. This does not change customer-facing behavior in the app. **PLEASE NOTE:** This option is managed for PodPlay admin access levels and may not be visible to every staff role. *** ### Tips * Give each key a clear **Display Name** so you can tell them apart (e.g. "CRM – Read only", "Marketing – Full access"). * Use **Read only** for as many keys as possible to limit what can be changed if a key is ever exposed. * Set keys to **Inactive** when you stop using an integration, instead of deleting them, so you can audit past usage. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.podplay.app/owners-playbook/build-your-club/company-settings/manage-api-keys.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.