API keys are created by Bookboost support rather than by you. You ask for one, we generate it, and it then appears in your own settings for you to copy and pass to whoever needs it.
If you are not sure what a key is for, start with What is an API key?
Getting a key
Ask support to generate one. Say what it is for, for example a website form integration or a specific vendor, so the key can be labelled sensibly from the start.
Wait for confirmation that it has been created.
Log in to Bookboost and open Settings.
Go to the Access tokens section. If you cannot see it, it has not been enabled on your account yet, so email support and we will enable it.
Copy the key and store it somewhere safe, a password manager rather than a document or a chat message.
Give it to the vendor or integration that needs it, and note down which one, so you know later what the key is doing.
The key is sent as a bearer token in the Authorization header of each request. Your developer will recognise the format; you do not need to do anything with it yourself beyond passing it on safely.
Replacing a key
Replace a key when a vendor relationship ends, when someone with access to it leaves, or when you think it may have been seen by someone it should not have been.
Settings > Access tokens has a Rotate control next to the key. Rotating takes effect immediately. The old key stops working the moment you rotate, so every integration using it breaks until you hand over the new one. Line up whoever needs the new key before you rotate, not after.
There is one key per account, so a rotation affects every integration at once. If several share the key, tell support which ones before you rotate so we can plan the swap with you rather than around you.
Keeping keys manageable
Label every key with the integration it serves. An unlabelled key is one nobody dares delete.
Review them when someone leaves. Keys belong to the account, not to a person, so they keep working after that person has gone.
Never send a key by plain email or chat. Use something like onetimesecret.com, which destroys the message once it has been read.
Rotate periodically rather than only after something has gone wrong. Because it is one key per account, plan it: line up every integration that uses it, then rotate once.
What this does not do
You cannot generate a key yourself. New keys go through support. The settings section shows the key on your account and lets you rotate it; it is not where keys are created.
A key does not expire. It works until it is replaced, which is why leavers and ended contracts are worth acting on.
Bookboost cannot tell you what a key is being used for. That is why labelling it when you receive it matters.
A key is not a role. It is not scoped by the roles and property access that apply to operators. See Operator roles for how human access works.
What to do next
If you are setting up an integration that needs a key, request it before the vendor asks. Generation is not instant, and it is the step most likely to hold up a go-live date.
For a worked example of a key in use, see Add subscribers to a list via the API.
Getting help
Open Help at the bottom of the left menu and choose Talk to us, or email support@bookboost.io.