---
title: "API keys"
description: "Org-scoped credentials for connecting hiy to other tools — create, revoke, and where they live."
source: https://hiy.ai/docs/api-keys
---

# API keys

An API key is a credential for your whole organization, not for one agent. It
is the thing an outside tool — [Zapier](https://zapier.com), a script, your
own backend — presents to prove it is acting on your behalf, the way your
signed-in session proves it when you're the one clicking.

[Zapier's triggers](/docs/zapier) are the first thing that accepts a key —
new lead, handoff requested, and an unanswered question, either as a live
REST hook or by polling. Actions (asking your agent a question, or adding a
source, from inside a Zap) are next on the [roadmap](/roadmap). If you're
building your own integration sooner, say so at
[hello@hiy.ai](mailto:hello@hiy.ai).

**Note:** Rolling out to selected workspaces first. Outside the early list, the API
keys card doesn't appear under Security and this page describes what's
coming rather than what's on your account yet. Ask at
[hello@hiy.ai](mailto:hello@hiy.ai) to be added early.

## Where keys live

Every agent's **Publish → Security** tab has an API keys card, right beside
the signing secret, for a workspace on the early list. Keys are shared across
every agent in your organization — create one from any agent's Security tab
and it works the same everywhere.

## Creating one

Give it a name — what it's for, like "Zapier" or "Warehouse export" — and
press **Create**. The full key is shown exactly once, in the response to that
one request. After that, only its first few characters (a prefix like
`hiy_AbCd1234…`) are ever shown again, so you can tell your keys apart in the
list without hiy holding anything that could reconstruct the rest.

**Note:** The key is hashed before it's stored, the same one-way transformation a
password goes through. There is no "reveal" button to come back to, because
there is nothing left to reveal — hiy could not show you the key again even if
asked to.

Copy it into whatever you're connecting before you navigate away. If you lose
it, there's no recovery: revoke it and create a new one.

## Keeping keys safe

A key is a bearer credential for your whole organization — anyone holding it
can do whatever it's authorized for, with no further check. Keep it out of
client-side code, a public repository, or a chat message, the same as you
would a password.

**Warning:** Treat a leaked key exactly like a leaked password: revoke it immediately and
create a replacement. There is no rotate-in-place for a key the way there is
for the signing secret — revoking and re-creating is the rotation.

## Revoking a key

Press **Revoke** next to any key in the list. It stops working immediately,
and the row stays in your list — grayed out, with the date it was revoked — so
you have a record that it once existed rather than a gap where it used to be.
Revoking is not undoable; if the same integration needs to keep working,
create a new key first and switch to it before revoking the old one.

Every plan includes API keys — there's no seat or plan gate on this page,
only the early-workspace rollout noted above.