API keys
An API key is a credential for your whole organization, not for one agent. It is the thing an outside tool — Zapier, a script, your own backend — presents to prove it is acting on your behalf, the way your signed-in session proves it when you're the one clicking.
Zapier's triggers are the first thing that accepts a key — new lead, handoff requested, and an unanswered question, either as a live REST hook or by polling. Actions (asking your agent a question, or adding a source, from inside a Zap) are next on the roadmap. If you're building your own integration sooner, say so at [email protected].
Note
Rolling out to selected workspaces first. Outside the early list, the API keys card doesn't appear under Security and this page describes what's coming rather than what's on your account yet. Ask at [email protected] to be added early.
Where keys live
Every agent's Publish → Security tab has an API keys card, right beside the signing secret, for a workspace on the early list. Keys are shared across every agent in your organization — create one from any agent's Security tab and it works the same everywhere.
Creating one
Give it a name — what it's for, like "Zapier" or "Warehouse export" — and
press Create. The full key is shown exactly once, in the response to that
one request. After that, only its first few characters (a prefix like
hiy_AbCd1234…) are ever shown again, so you can tell your keys apart in the
list without hiy holding anything that could reconstruct the rest.
Note
The key is hashed before it's stored, the same one-way transformation a password goes through. There is no "reveal" button to come back to, because there is nothing left to reveal — hiy could not show you the key again even if asked to.
Copy it into whatever you're connecting before you navigate away. If you lose it, there's no recovery: revoke it and create a new one.
Keeping keys safe
A key is a bearer credential for your whole organization — anyone holding it can do whatever it's authorized for, with no further check. Keep it out of client-side code, a public repository, or a chat message, the same as you would a password.
Warning
Treat a leaked key exactly like a leaked password: revoke it immediately and create a replacement. There is no rotate-in-place for a key the way there is for the signing secret — revoking and re-creating is the rotation.
Revoking a key
Press Revoke next to any key in the list. It stops working immediately, and the row stays in your list — grayed out, with the date it was revoked — so you have a record that it once existed rather than a gap where it used to be. Revoking is not undoable; if the same integration needs to keep working, create a new key first and switch to it before revoking the old one.
Every plan includes API keys — there's no seat or plan gate on this page, only the early-workspace rollout noted above.