Authorize your integration

Sign in to the correct organization and open Developers to create an API key. Save the complete value when it is displayed; subsequent listings show a prefix for identification.

Send the key

Keep the credential in your backend's secret store. Send it as the X-API-Key header on each request. The v2 integration routes require this header; browser login tokens are not a substitute. /api/v2/status and the OpenAPI document are public.

New application keys use the itc_ prefix. Validation compares the stored key hash, so previously issued keys remain valid without a prefix migration. The organization attached to the key determines the records it may access.

Replace or revoke a credential

Create a replacement, update your integration, confirm a successful request, then archive the old key. Archived or invalid keys are rejected. Do not put a key into a website widget, public repository or URL.

Model-provider credentials and IntraCord Service Keys are configured separately. Use the credential guide to choose the right type.