API keys

API keys let your code, scripts or external tools talk to the Zendrhax API without using login credentials.

Who can access /api-keys: only the workspace Owner. Workspace Admins do not have access to this page. Plan requirement: the workspace's plan must include the tenant_api_keys (or api_access) feature. On plans without it, attempts to create a key return feature_not_available.

#Per-plan quotas

The platform plan caps how many active API keys a workspace can hold at once:

You can always revoke a key to free up a slot.

#Create a key

1. Sign in as the workspace Owner.
2. Open /api-keys.
3. Type a name ("Zapier integration", "Internal dashboard", etc.) and click Generate and Download Key.

The browser downloads the full plaintext key once as a protected, non-cacheable attachment; Zendrhax never renders it into HTML or stores it in the session. The format is sk_ followed by 64 hex characters. Move the file to your secret manager and delete the downloaded copy. We only store the SHA-256 hash, so if you lose the key you must revoke it and generate a new one.

#Use a key

Send it as the Authorization: Bearer <key> header on every API request:

GET /api/invoices HTTP/1.1
Host: app.zendrhax.com
Authorization: Bearer sk_a1b2c3d4e5f6...

The key is scoped to the workspace it was created in. It cannot read or modify data from any other workspace, even if you also belong to those.

#Revoke a key

1. Open /api-keys.
2. Click Revoke on the row of the key you want to disable.

A revoked key is dead immediately — anything still using it gets 401 Unauthorized on its next request. Revoking also frees up the slot toward your plan quota.

#Security best practice

• One key per integration. If a key leaks you revoke just that one without breaking the rest.
• Never commit a key to a public git repo. GitHub auto-scans for secrets, but a leaked key is a leaked key.
• Delete the downloaded credential file after placing the key in your secret manager.
• Rotate keys when someone with access leaves. Same as passwords.
• Use rate-limit headers the API returns to back off before tripping the limiter.