Admins create keys in Settings → API keys. A key belongs to the organisation, not to the person who made it, so it keeps working when they leave.
Creating one
- Name it after what uses it — "ERP nightly sync" — so it can be told apart later.
- Choose a role: viewer, technician or admin. Never owner, since owner controls billing.
- Choose an expiry between 1 and 730 days, or none.
The key starts with act_ and is shown once. We store only a hash of it, so it cannot be shown again; if it is lost, revoke it and create another.
What a key cannot do
Keys cannot manage other keys, accept invitations or create organisations. Those actions belong to a person.
If a key leaks
Revoke it. It stops working on the next request. The event log records what it did, under the key's name.