API keys
Create, scope, rotate and revoke keys; roles, IP allowlists and expiry.
Rolling out
API keys are available to selected organizations while they roll out. If you don't see Developers in Settings, ask the Invyte team to turn API keys on for your organization.
Who can manage keys
Admins, and people with the Developer role. You can only give a key a role you could give a person yourself.
An admin first turns API access on in Settings → Developers. While it's off, every key of the organization is refused; turning it back on restores them.
Create a key
In Settings → Developers, choose Issue key and set:
| Setting | Notes |
|---|---|
| Name | What the key is for, such as "Careers site sync". |
| Role and scope | The role the key holds, at organization, Client or Job scope. |
| Expiry | Required. 90 days by default, at most a year. |
| IP allowlist | Optional. Only requests from these addresses (CIDR ranges) are accepted. |
| Allow paid operations | Off by default. See Paid operations. |
You must have signed in within the last 15 minutes to create or rotate a key.
The key looks like ink_live_… and is shown once. Invyte stores only a fingerprint of it, so it can't show it to
you again: copy it straight into your secret manager.
Rotate
Choose Rotate to get a new key while the old one keeps working for an overlap you choose (up to 7 days). Move your systems to the new key; the old one is revoked automatically when the overlap ends.
Revoke
Revoke stops a key on its very next request. Revoke at once if a key may have leaked.
Leaked keys
If a key is pushed to a public GitHub repository, GitHub tells Invyte, the key is revoked automatically and your admins are emailed.
Keeping track
Settings → Developers shows each key's role, expiry, when it was last used and from where, and a log of its requests (operation, time and outcome; never the data). Admins are emailed when a key is created, a week before it expires, and when the person who created it leaves the organization.
Good practice
- One key per system, with the smallest role and scope that works.
- Keep keys in a secret manager, never in code or URLs.
- Set an IP allowlist for servers with fixed addresses.
- Rotate on a schedule, and whenever someone with access leaves.