Creating and Revoking API Keys for the BackOps API
How organization admins create an API key, use it to call the BackOps API, see when it was last used, and revoke it when it is no longer needed.
An API key lets a tool you control call the BackOps API as your organization, without anyone signing in. Use one for a reporting script, a scheduled export, or a connector to another system. Only organization admins can manage keys, from Settings › API Keys.
Create a Key
Open API Keys
Select Add API key
Name the key
Give it a name that says what uses it, such as "Nightly finance export". The name is required, and it is what BackOps shows as the actor when the key makes a change.
Choose an expiry date
Set Expires on if the key should stop working on a known date. If you leave it blank, the key still stops working one year after it was created.
Copy the key
Select Create. The key is shown once, with a copy button. Store it somewhere safe, such as a password manager. BackOps never shows it again, so a lost key has to be replaced with a new one.
Use a Key
Send the key as a bearer token in the Authorization header of each request:
Authorization: Bearer <your API key>
A key acts for the organization that created it, across the Event, Organization, and Notifications APIs. BackOps checks that the key is active and not expired, and updates its Last Used time, when it has not seen the key recently, so Last Used is approximate. A key can create events without using a BackOps Pro seat, because integrations do not need a license seat. A key cannot create, list, or revoke API keys; that takes a signed-in admin.
The operations a key can call are listed under API Documentation in the docs navigation. The key operations themselves are create, list and revoke.
Review and Revoke Keys
The API Keys list shows each key's Name, Status (Active or Revoked), Created, Last Used, and Expires dates, newest first. A key left without an expiry date shows an empty Expires column even though it expires one year after creation.
To revoke a key, open the row menu on an active key, select Revoke, and confirm. Revoking cannot be undone. Some BackOps services remember that a key is active, so a revoked key keeps working there until it has gone unused for 15 minutes. Stop the tool that uses a key before you revoke it.