Authentication & API keys

Every request is authenticated with a personal API key sent as a Bearer token.

Authorization: Bearer az_live_YOUR_KEY

Creating a key

In the Apizeal app: Integrations → API Keys → Create API key. The full key is shown once — store it in a secrets manager. Only its fingerprint is kept on our side, so it can never be recovered; if you lose it, create a new one.

Keys are personal: the API returns what your user can see in the app.
az_live_ keys work against production. az_test_ keys are internal to Apizeal.
You can have up to 2 active keys — by design, so you can rotate.

Rotating without downtime

Create a second key.
Deploy it to your integration.
Revoke the old key. Revocation takes effect within 5 minutes.

Expiration

When creating a key you may set it to expire in 90 days or 1 year. We email you 30, 7 and 1 day(s) before it expires. An expired key stops working immediately and is revoked automatically.

IP allowlist (recommended)

You can restrict a key to your servers' IPs or CIDR ranges (up to 20 entries) when creating or editing it. Outside those addresses the key is rejected with 403. It is the strongest protection against a leaked key.

Key lifecycle emails

You receive an email whenever a key is created or revoked on your account, and before a key expires. If you get one you don't recognize, revoke your keys from Integrations → API Keys and contact support.

Keep your key secret. Never commit it to a repository, put it in a URL, or share it in tickets. Anyone with your key can read your data until you revoke it.