An API key lets an external application, such as your website backend, a script or an integration platform, call the InstantCampaign API on behalf of your workspace. Each key belongs to one workspace and can be limited to specific permissions (scopes).
Managing API keys needs the API keys permission. Owners and Administrators have it, and a custom role can grant it. Members without it do not see API Keys in the settings menu. Create a key
Open API Keys
Go to Settings → Developers → API Keys and click Create New Key.
Name the key
Enter a Key Name that says where the key will be used, for example “Checkout service” or “Zapier”. The name is only for you; it is how you tell keys apart in the list.
Set an expiry date (optional)
Pick an Expiry Date if the key should stop working on a given day. Leave it empty for a key that never expires.
Choose permissions
Under Permissions, tick the scopes this key needs. If you tick nothing, the key has Full access.
Create and copy the key
Click Create Key. The Your New API Key dialog shows the full key once. Click Copy Key and store it in your secret manager.
The full key is shown only once. InstantCampaign stores only a hash, so a lost key cannot be recovered. Delete it and create a new one.
Permissions (scopes)
Give each key only the scopes it needs. A key with scopes can call only the endpoints those scopes cover. Any other call returns 403 with code: "insufficient_scope". Most endpoints also name the missing scope in requiredScope. Transactional send and validate, public events and the MCP server don’t, so check code.
A key for a checkout service that only sends receipts needs just Transactional — send. If that key leaks, it cannot read or export your contacts.
Keys created before scopes existed have no scopes and keep full access. They show a Full access badge in the list.
The key list
Each key shows its Name with its scopes (or Full access), the Prefix (the first characters of the key, so you can match it to your config), when it was Created, when it was Last Used, and when it Expires. An expired key has an Expired badge and is refused by the API.
Revoke a key
Click the delete icon on the key’s row, then Delete Key in the Delete API Key dialog. Any application using the key stops working immediately.
To rotate a key without downtime, create the new key first, deploy it, check that the old key’s Last Used date stops changing, then delete the old key.
Changing a key’s permissions
You cannot edit a key’s scopes in the app. To change them, create a new key with the scopes you want and delete the old one.
Troubleshooting
