Skip to main content
Phynxa

API keys

Create and revoke developer API keys, send them to the API, and know what a key can and cannot reach.

What you will achieve

You will have a key that lets your own code use your workspace.

Prerequisites

  • The owner or admin role.

Step-by-step setup

  1. Open Settings and the Profile & Account tab, and find Developer API Keys ("Keys for connecting your own apps to Phynxa").
  2. Choose Create API Key (or Create your first key).
  3. Enter a Key Name, for example "Zapier Integration" or "Production CRM", and choose Generate Key.
  4. The Important Secret Notice appears: "This key will not be shown again, so store it somewhere safe." Choose Copy Key and store it, then Done.

Use the key

Send it as a Bearer token:

bash
curl https://phynxa.com/api/agents \
  -H "Authorization: Bearer nxa_live_YOUR_KEY"

A key looks like nxa_live_ followed by 40 characters. The list in Settings shows only its last four characters, its Created date and its Last Used time.

What a key can reach

A key acts as an admin of the workspace it was made in, on these parts of the API only:

agents, calls, contacts, campaigns, tools, knowledge, webhooks, forms, captures, scheduled-calls, stats and insights.

It cannot reach settings, team, billing, your account, integrations or other keys. A request to those paths with a key is answered 401 Sign in to continue.

Limits

  • 600 requests per minute per key. Beyond that you receive 429 with "Rate limit reached for this key."
  • Calls placed through the API count against the hourly dialling caps (20 per person, 200 per workspace).

Revoke a key

In the list, choose Revoke on the key and confirm ("Revoke Developer API Key"). It stops working at once. Do this if a key may have leaked.

Usage

The API Usage tab of Settings shows Total API Requests, Active API Keys, Tools & Actions Used and API Success Rate, a breakdown per tool and endpoint, and recent activity.

Testing

Call GET /api/agents with your key. You should receive a JSON list of your agents. Then check that Last Used updates in Settings.

Expected result

200 with your agents. With a wrong or revoked key: 401 {"detail":"Sign in to continue."}.

Troubleshooting

  • 401 with a correct key. The path is not one a key may use, or the key was revoked.
  • Lost the key. It cannot be shown again. Create a new one and revoke the old.

Security and credentials

Treat a key like a password: do not put it in a browser app or a public repository. Use one key per integration so you can revoke one without breaking the rest.

Related guides

Something here does not match what you see in the dashboard? Let us know.