API key
An API key is a secret string that proves another system is allowed to read your data. It works like a password — except a program supplies it rather than a person, and it stays valid until you revoke it.
The key is created in settings and shown exactly once. Store it immediately in an environment variable or a secret manager on your server; you cannot read it back later, because it is stored in a form the original value cannot be derived from.
The most common mistake is putting the key in page JavaScript. Browser source is public — anyone can copy the key and download every response from every one of your forms. API calls therefore belong on a server that holds the key and returns only what is meant to be public.
If a key leaks, do not investigate whether anyone used it — revoke it and issue a new one. Revocation is immediate and the old key stops working.
In practice
- The key belongs in a server-side environment variable, not in a repository and not in the front end.
- Prefer a separate key per integration, so you can revoke just that one.
- Rotate the key when someone who knew it leaves.
FAQ
Where do I create an API key?
In Settings → API keys. It is displayed only once.
How is the key sent?
In an Authorization: Bearer <key> header, or in an x-api-key header.
What happens when I revoke a key?
It stops working immediately and integrations using it receive a 401.
Related
Try Gatherino for free
Free plan: 3 forms and 100 responses a month. No credit card, EU-hosted data.
Get started free →