API Keys

API keys let you authenticate programmatic requests to the Sift REST API. Each key is scoped to your organization.

At a glance

Generating a Key

1. Go to Settings → Connections → Developer access (/app/settings/api-keys).
2. Choose a name, permission profile, and expiry. Create the key.
3. Copy the key immediately - it will not be shown again.

Using Your Key

Pass the key in the X-API-Key header on every request:

GET https://api.getsift.ai/v0/action/list
X-API-Key: sk_live_your_key_here

Scopes

Developer access defaults to Reporting, with the read scope. Choose Write for general writes or Read and write for both. General write permission does not grant Custom API ingestion.

For Custom API, create an Import key under Settings → Connections → Developer → API keys. The source's Setup tab links there with the source preselected. It grants ingest and ingest:read for selected sources. It can validate, import, correct items, retry failed intake, and read receipts. It cannot read reporting data or send replies.

Use separate keys for ingestion and reporting. Expiry options are 30 days, 90 days, or no expiry. The default is 90 days.

Revoking a Key

You can revoke any key at any time from the same Developer access settings page. New requests fail after revocation. Do not assume revocation cancels a request already in progress.

Best Practices

• One key per integration. Don't share a single key across multiple systems. If one integration is compromised, you can revoke only that key without disrupting others.
• Rotate regularly. Generate a new key, update your integration, then revoke the old one.
• Never commit keys to source control. Store them in environment variables or a secrets manager.

Related