API Keys
Support-issued tokens are broad. When you want a key for one job — a Zapier zap that posts into chat, a script that syncs knowledge, a form-collection integration — mint a capability-scoped key yourself: long-lived, pinned to one app, limited to exactly the capabilities you grant, revocable at any time. No dashboard sign-in needed for the integration that uses it.
The
/data/prefix. Everything under/api/v1/apps/{appId}/data/…is the app's Data API — the surface for records an app captures or owns (today:data/api-keysfor scoped keys, with form records following the same pattern). New captured-record kinds will appear under this prefix as they ship; sub-routes carry their own permission gates.
Requires manage_api_keys (owner by default). Keys can
also be minted from the dashboard's Credentials tab.
Returns the raw token once — it is never stored or shown again; store it like a password.
Capabilities: chat (POST
/apps/{appId}/chat on the key's own app),
knowledge (knowledge-base routes), forms (the
app's form-record routes under /apps/{appId}/data/).
Anything outside the granted classes returns
403 API_KEY_SCOPE.
curl -X POST https://api.everycallhandled.com/api/v1/apps/$APP_ID/data/api-keys \
-H 'Authorization: Bearer YOUR_TOKEN' \
-H 'Content-Type: application/json' \
-d '{ "label": "Zapier integration", "capabilities": ["chat", "knowledge"] }'Exactly like a session token. A key is pinned to the app it was
minted on and acts with a viewer role plus its
capability-derived permissions — it can never widen itself. Usage joins
the same credit ledger as every other channel.
Authorization: Bearer <your-api-key>Requires manage_api_keys. Listing returns metadata only,
never tokens. Revoking kills the key at the next auth lookup (subsequent
requests get 401).
curl 'https://api.everycallhandled.com/api/v1/apps/{appId}/data/api-keys' \
-H 'Authorization: Bearer YOUR_TOKEN'curl -X DELETE 'https://api.everycallhandled.com/api/v1/apps/{appId}/data/api-keys/{id}' \
-H 'Authorization: Bearer YOUR_TOKEN'