API keys
Create, use, and revoke API keys on Pro: who can manage them, how they're stored, what they can reach, and what to do if one leaks.
An API key lets your own server call the subscriber API as your workspace. Keys start with ik_live_, so you can recognise one in code or logs.
Before you start
- Your workspace is on Pro or Custom.
- You're a workspace admin.
- You have somewhere safe to store the key: your server's environment variables or a secrets manager.
Create a key
- 1Go to Settings → API keys & webhooks.
- 2Under API keys, enter a New key name, up to 60 characters.
- 3Select Create key.
- 4Copy the key from the dialog and store it. Select I've saved it.
The full key is shown once. After you close the dialog, only its first 12 and last 4 characters are visible.
Use a key
Send it in the Authorization header on every request:
X-API-Key: ik_live_…is accepted too.- A key can call four subscriber endpoints and nothing else. The list is in the API guide, and under What a key can call in Settings.
- 60 requests a minute per key.
- Changes made with a key show in your activity log as
api-key ik_live_….
curl "https://influencerskit.com/api/subscribers/status-counts" \
-H "Authorization: Bearer $IK_API_KEY"What you see for each key
| Field | Meaning |
|---|---|
| Name | What you called it. |
ik_live_Ab12…wxyz | The first 12 and last 4 characters, to tell keys apart. |
| Created | When, and by whom. |
| Last used | The last request made with it. Updated at most once a minute. |
Revoke a key
The next request with that key gets 401 INVALID_API_KEY. Revoked keys stay listed under Revoked keys, with who revoked them and when. You can have 10 active keys at a time.
- 1Go to Settings → API keys & webhooks.
- 2Select Revoke on the key and confirm.
If a key leaks
- 1Create a new key and put it where the old one was used.
- 2Revoke the leaked key.
- 3Check your subscribers and your activity log for changes you didn't make.
Use one key per system, so you can revoke one without breaking the others.
How keys are kept safe
- Only a SHA-256 fingerprint of the key is stored, never the key.
- A key only reaches its own workspace's subscribers.
- A key can't manage keys, webhooks, team, billing or settings, and can't sign in to the dashboard.
- A key can't move an unsubscribed person back to active.
- When your plan stops including API access, or your account is suspended, keys stop working until that changes.
Frequently asked questions
Which plan includes API keys?
Pro, and Custom. On other plans, and during the free trial, Create key is off and existing keys return 403 API_NOT_IN_PLAN.
I lost a key. Can you show it again?
No. Only a fingerprint of the key is stored, so nobody can read it back. Create a new key, switch your code to it, then revoke the old one.
Who can create keys?
A workspace admin, signed in as themselves. Managers can see the list but not create or revoke. InfluencersKit staff can't create keys for you, even when they're viewing your account.
Does a key stop working when the person who made it leaves?
No. Keys belong to the workspace. Revoke a key when the person or system using it no longer should.
Ready to try it?
Open your dashboard and follow along — or create a free account.