Skip to main content
Every request carries an API key in the X-API-Key header:
Authorization: Bearer vak_call_… works too, if your HTTP tool prefers it.

​
Creating and revoking keys

An admin of your account manages keys in Settings → AI calling → API & webhooks:
  • Create key issues a new key. It is shown once; we store only a hash and cannot show it again.
  • An optional expiry date makes the key stop working at the end of that day.
  • Revoke stops a key at once. Calls it already queued still go ahead.
Use one key per system (CRM, website, automation tool). The table shows when each key was last used, so you can see which ones are still needed and revoke the rest.

​
Scopes

A key created in the dashboard can do everything below. A request the key is not allowed to make fails with 403 insufficient_scope.

​
Errors

​
Keeping keys safe

  • Call the API from your server only. A key inside a web page or an app can be read by anyone who opens it.
  • Store keys in a secret manager or environment variables, not in code.
  • If a key may have leaked, create a new one, switch your system to it, then revoke the old one.