API keys
API keys: what they are, how to get one, and how they behave.
API keys let your own systems and agents authenticate to iCustomer. They are the credential behind the API and the MCP surface.
Getting a key
Keys are issued by your forward-deployed engineer. Email support@icustomer.ai from your workspace's owner or admin account and say what the key is for.
How keys behave
A key is shown once, at creation. Copy it then. Only a short prefix is displayed afterward.
A key has full access to your workspace, so treat it like an owner credential.
Keys are revocable, and can carry an expiry.
Rotation is zero-downtime: issue the new key, move your integrations over, then retire the old one.
Keeping keys safe
Store keys in a secret manager, never in code or a shared document.
Rotate on a schedule, and immediately if a key may have been exposed.
If a key is compromised, revoke it right away through your forward-deployed engineer, then issue a replacement. Actions taken with the old key stay on record in your decision traces.
Everything the platform does is also available in the app, and your connected tools authenticate through your stack, not API keys. Agents connect through Bring your own agent.
Last updated