API keys are created by Bookboost support rather than by you. You ask for one, we generate it, and it then appears in your own settings for you to copy and pass to whoever needs it.
If you are not sure what a key is for, start with What is an API key?
Getting a key
Ask support to generate one. Say what it is for, for example a website form integration or a specific vendor, so the key can be labelled sensibly from the start.
Wait for confirmation that it has been created.
Log in to Bookboost and open Settings.
Go to the Access Tokens section. If you cannot see it, it has not been enabled on your account yet, so email support and we will enable it.
Copy the key and store it somewhere safe, a password manager rather than a document or a chat message.
Give it to the vendor or integration that needs it, and note down which one, so you know later what the key is doing.
The key is sent as a bearer token in the Authorization header of each request. Your developer will recognise the format; you do not need to do anything with it yourself beyond passing it on safely.
Replacing a key
Replace a key when a vendor relationship ends, when someone with access to it leaves, or when you think it may have been seen by someone it should not have been.
Contact support to arrange it, and have the vendor ready to take the new key. Tell us which integration the key belongs to so we can plan the swap with you rather than around you.
Keeping keys manageable
Label every key with the integration it serves. An unlabelled key is one nobody dares delete.
Review them when someone leaves. Keys belong to the account, not to a person, so they keep working after that person has gone.
Never send a key by plain email or chat. Use something like onetimesecret.com, which destroys the message once it has been read.
Rotate periodically rather than only after something has gone wrong.
What this does not do
You cannot generate or delete a key yourself. Both go through support. The settings section shows you the keys on your account; it is not where they are created.
A key does not expire. It works until it is replaced, which is why leavers and ended contracts are worth acting on.
Bookboost cannot tell you what a key is being used for. That is why labelling it when you receive it matters.
A key is not a role. It is not scoped by the roles and property access that apply to operators. See Operator roles for how human access works.
What to do next
If you are setting up an integration that needs a key, request it before the vendor asks. Generation is not instant, and it is the step most likely to hold up a go-live date.
For a worked example of a key in use, see Add subscribers to a list via the API.
Getting help
Open Help at the bottom of the left menu and choose Talk to Us, or email support@bookboost.io.