API Keys
An API key is what proves a request really comes from your account. You use it to send form data through the Inletbase API, and the no-code plugins use one behind the scenes too. You manage your keys under Settings, on the API Keys screen.
What an API key is
Each key is a long secret that starts with ib_live_. You include it when you call the Inletbase API, like this:
Authorization: Bearer ib_live_...
Managing keys is an admin task. Only admins can create, reveal, or revoke them.
Create a key
- On the API Keys screen, click Generate New Key.
- Give it a name so you remember what it is for, like Production Server.
- Click Generate Key.
- Copy the key that appears and store it somewhere safe.
Inletbase shows the full key right after you create it and reminds you to copy it. You can also reveal it again later (see below).
The keys list
Your active keys are listed with a few details:
- Name, plus a small badge if the key was created by a WordPress or Webflow connection.
- Key prefix, the first part of the key, shown so you can tell keys apart without exposing the whole thing.
- Created date and Last used date (or Never if it has not been used yet).
- Actions to reveal or revoke the key.
Reveal a key
For most keys, you can click the eye icon to show the full value again and copy it, which is handy if you did not save it the first time. A few older keys cannot be revealed. If that is the case, just generate a new key and use that instead.
Revoke a key
Click the trash icon next to a key and confirm to revoke it. This takes effect immediately and cannot be undone, so any code or integration still using that key will stop working. If the key belongs to a WordPress or Webflow connection, that site will stop until you reconnect it.
Revoke a key any time you think it has been shared by mistake or is no longer needed.
Using your key
For the full request format, endpoints, and examples, see the API reference. If you use our no-code apps, they handle the key for you: the WordPress and Framer connections can set one up automatically when you connect.
Keeping keys safe
- Treat a key like a password. Use it from your own server or a trusted app, not in public code.
- Give each integration its own key so you can revoke one without affecting the others.
- Revoke a key the moment you suspect it has leaked, then create a fresh one.
Frequently asked questions
Where do I find my API keys?
Open Settings and go to API Keys. Creating, revealing, and revoking keys are admin actions.
What does an Inletbase API key look like?
It starts with ib_live_ followed by a long random string. You use it in the Authorization header as a Bearer token.
Can I see a key again after I create it?
Usually yes. Newer keys can be revealed again with the eye icon in the list. Some older keys cannot be revealed, and for those you just generate a new key.
Who can create or revoke keys?
Only admins. Members cannot create, reveal, or revoke API keys.
What happens when I revoke a key?
It stops working right away, and this cannot be undone. Any code or integration using it will fail until you switch to a new key. If the key belongs to a WordPress or Webflow connection, that site stops working until you reconnect.