Skip to main content
API keys are created and managed from Settings → API in the Secfix web app — not through the API itself. Each API key belongs to a workspace, holds a single active token at a time, and is granted an access level. Every key has a client ID and a client secret used to authenticate.

​
Create an API key

1

Open Settings → API

In the Secfix web app, go to Settings → API. You need permission to manage API keys in your workspace.
2

Create the API key

Give it a name, then choose its access level. Grant the minimum the integration needs — for example Read for a read-only inventory sync. See Scopes.
3

Copy the client secret

On creation you receive a client_id and a client_secret. The secret is displayed once and never shown again — store it in your secrets manager immediately. You can always rotate it later.

​
Access levels

Each API key is granted one of three access levels, which map to the underlying scopes: all:read grants read access to every resource and all:write grants write access to every resource — see Scopes.

​
Rotate the secret

Rotating an API key’s secret issues a new client_secret and immediately invalidates the current access token — the single-active-token rule means the previously issued token starts returning 401 token_superseded. After rotating, fetch a fresh token with the new secret. See Authentication.

​
Delete an API key

Deleting an API key permanently revokes its credentials and any active token. Requests made with its token afterward fail with 401 unauthorized.
There is no API to create or manage API keys — this is a deliberate security boundary. The credential lifecycle lives entirely in Settings → API in the Secfix web app.