API keys
Create, edit and revoke the keys your own servers use to call Inkwave's publisher API.
What an API key is for
An API key lets code you run, such as your own signup form, CRM sync or reporting script, call Inkwave's publisher API for this publication. You manage keys under Settings, API. Only the owner and admins can open this page.
Keys are for servers only. Never put one in a web page or an app, where anyone could copy it. API keys are separate from MCP keys: an API key doesn't work for an AI assistant, and an MCP key doesn't work on the API.
For the endpoints, limits and examples, see the Publisher API reference on docs.inkwave.space.
Creating a key
- Click Create key.
- Enter a Key name you'll recognise, such as "Website signup form".
- Choose when it Expires: in 30 days, 90 days, 1 year, or never. 90 days is the default.
- Tick what the key may access. See What a key may access.
- Click Create key.
The key, beginning inkw_api_, is shown once. Copy it with Copy key, or use Copy a test request, key included to get a ready-made curl command. Inkwave keeps only a scrambled copy, so if you lose the key you'll need to revoke it and create another. Tick I've saved this key somewhere safe to close the window.
What a key may access
Every key can read your publication's name, address and plan. On top of that, tick only what the integration needs:
| Permission | Lets the key |
|---|---|
| Audience stats | Read growth, active and unsubscribed counts and list health. No individual subscribers. |
| Subscriber list | Read individual subscribers, your tags and your custom fields. Not email addresses. |
| Subscriber email addresses | Add email addresses to what it reads about subscribers, segment members and comment authors, and search by email. |
| Posts and post stats | Read your published posts and their stats. |
| Add and unsubscribe subscribers | Add subscribers and unsubscribe them. It can't delete anyone. |
| Revenue | Read paid subscriber counts, MRR and ARR, new and churned paid subscribers, revenue collected, and your paid tiers and their prices. No card details or email addresses. |
| Manage tags and custom fields | Create tags, add or remove a subscriber's tags, and set or clear a subscriber's custom field values. It can't delete a tag or a field. |
| Segments | Read your segments, their sizes and the subscribers in each. |
| Comments | Read website comments on your published posts, with the commenter's name. It can't hide, approve or delete them. |
Subscriber email addresses, Add and unsubscribe subscribers, Manage tags and custom fields and Segments need Subscriber list, so ticking any of them ticks that too, and it stays ticked until you untick them.
Revenue, Manage tags and custom fields, Segments and Comments are off by default, and keys created before they were added don't have them. To give an existing key one of them, use Edit permissions.
The key list
Each key shows its name and the start of the key, what it can access, when it was created, when it was last used, when it expires, and whether it is Active, Expired or Revoked. Revoked and expired keys stay on the list.
Base URL at the top of the page is the address your code sends requests to, with a copy button. API guide opens the full reference.
Editing and revoking
From the menu on a key:
- Edit permissions changes what the key may access. The change applies to its next request, and the key itself stays the same, so nothing needs updating on your server.
- Revoke stops the key at once. It can't be undone.
An expired key can only be revoked. To keep using the API, create a new key.
Plans
The API needs the API access plan feature. Without it, you can't create a key, and existing keys are refused until the plan includes it again. They work again after an upgrade. Your plan also sets how many API requests the publication can make a day.