Browse the docs
Account
API keys
Create and revoke workspace API keys, keep them safe, and see what a key can read today while full API access is still coming soon in ASDK's early access.
Last updated
On this page
API keys let your own servers and scripts call the ASDK API on behalf of a workspace, without a person signing in. This page explains how to create, use and revoke keys, and what they can do during early access.
Create a key
Open API keys
Open Settings → API. Only owners and admins can see and manage keys.
Create the key
Choose Create key. Give it a Key name that says where it will be used, such as "Production server" or "Nightly export", choose its access, Read or Read and write, and choose Create key in the dialog.
Copy it now
The Copy your new key dialog shows the full key once. Copy it into your password manager or your server's secret store, then choose Done. ASDK keeps only a fingerprint of the key, so nobody can show it to you again; if you lose it, create a new one.
A key looks like asdk_live_ followed by 43 letters and digits. A workspace can have up to 25 active keys.
Use a key
Send the key in the Authorization header of each request to https://api.asdk.com:
curl https://api.asdk.com/v1/workspaces/wsp_YOUR_WORKSPACE_ID/sites \
-H "Authorization: Bearer asdk_live_YOUR_KEY"Your Workspace ID is under Settings → Workspace. A key works only for the workspace it was created in.
What a key can read today
| Request | Returns |
|---|---|
GET /v1/workspaces/{id} | The workspace and its plan |
GET /v1/workspaces/{id}/sites | Its sites and their knowledge status |
GET /v1/sites/{siteId} | One site |
GET /v1/sites/{siteId}/sources | The site's knowledge sources and their status |
GET /v1/sources/{sourceId} | One source, with progress of the last sync |
GET /v1/sources/{sourceId}/documents | The pages and documents a source produced |
GET /v1/sites/{siteId}/qa | The site's Q&A pairs |
For example, a monitoring script can check every morning that each source is Ready and alert you when one needs attention. A key with Read and write access can also add Q&A pairs, sync sources, change lead statuses and manage webhooks; see Authentication and API key scopes.
Responses are JSON. Errors use the standard problem format (application/problem+json) with a type such as not-found or rate-limited. A request for another workspace's data answers "not found", as if it didn't exist.
Keep keys safe
A key acts for your whole workspace, so treat it like a password:
- Use keys on servers only. Never put a key in your website's HTML, in the widget snippet or in a mobile app: anyone could read it there. The widget doesn't need a key.
- One key per use. Separate keys for separate scripts let you revoke one without breaking the others, and Last used tells you which keys are still in use.
- Don't commit keys to code repositories. Load them from environment variables or a secret manager.
- Revoke keys of people who leave, if they created keys for their own tools.
Revoke a key
In the Active keys list, choose Revoke next to the key and confirm with Revoke key. Anything using the key stops working immediately. This can't be undone: to restore access, create a new key and update the script.
Revoke a key right away if it may have been exposed, for example pasted into a chat or pushed to a public repository. Then create a replacement.
Keys and the widget
The widget on your website doesn't use API keys. It identifies your site by its public Site ID and works only on your site's allowed domains. To control the widget from your website's code, use the JavaScript API instead.
Related: Members and roles, Workspaces.