# How to Set Up an API Key

Source: https://docs.astalty.com.au/developers/api/how-to-set-up-an-api-key

> Create and manage API keys, choose an access level, and access the API Dashboard.

Astalty Premium - This feature is part of the Astalty Premium plan. See What Premium includes.

## Overview

Use the API Dashboard to create, edit and delete API keys and to review API request history.

The Account Owner can open the API Dashboard and can grant an Admin the **Can manage API keys and webhooks** permission. See [Grant API Key and Webhook Access](https://docs.astalty.com.au/guide/roles-and-permissions#granting-api-key-and-webhook-access). Everyone with that permission can see and manage all keys for the account.

## How to Access the API Dashboard

1. Open [Settings](https://app.astalty.com.au/settings).
2. Select [API Dashboard](https://app.astalty.com.au/api/dashboard).

![The Settings page open on Business, with an arrow pointing to API Dashboard at the bottom of the settings menu.](https://docs.astalty.com.au/assets/settings-api-1758520913.png)

## How to create an API Key

1. From the API Dashboard, select [Manage Keys](https://app.astalty.com.au/api/keys).

![The API Dashboard showing the API Request History table, with an arrow pointing to Manage Keys in the side menu below API Dashboard and Mobile Dashboard.](https://docs.astalty.com.au/assets/api-key-creation-manage-keys.png)

2. Select **Create API Key**.

![The Manage Keys page showing an empty API Keys table with Name, Last used at and Created at columns, and an arrow pointing to the Create API Key button.](https://docs.astalty.com.au/assets/api-click-create-key.png)

3. Enter a **Name** that identifies the integration.

4. Choose an **Access Level**:

   - **Full Access** can read and change supported account data.
   - **Read Only** can read data but cannot create, update or delete it.

5. Select **Create**.

6. Copy the key and store it in your integration's secrets manager before closing the dialog.

> **Copy the key before closing**
>
> Astalty only shows the key once. If you close the dialog without saving it, delete that key and create another one.

![The API Key Created dialog showing the generated API key with a warning that it will not be shown again, and an arrow pointing to the Copy to clipboard button beside it.](https://docs.astalty.com.au/assets/api-copy-the-key.png)

## Access levels

Each key's access level controls whether it can make write requests.

| Access level    | What the key can do                                                                |
| --------------- | ---------------------------------------------------------------------------------- |
| **Full Access** | Can read data as well as create, update and delete it.                             |
| **Read Only**   | Can read data. Requests that create, update or delete data return `403 Forbidden`. |

For most API operations, a key is not restricted by the key owner's other Astalty permissions. Finance endpoints are the exception and require the key owner to have Finance access. Read [API Authentication and Permissions](https://docs.astalty.com.au/developers/api/authentication#access-levels-and-permissions) before issuing a Full Access key.

> **Use the least privilege needed**
>
> Choose **Read Only** when the integration only retrieves data. Create a Full Access key only when the integration must make changes.

## Changing an existing key's access level

1. Open [Manage Keys](https://app.astalty.com.au/api/keys).
2. Open the key's action menu and select **Edit**.
3. Select **Full Access** or **Read Only**.
4. Select **Save**.

The change applies to later requests that use the key. The keys table shows the access level, last-used date and creation date for each key. Use **Delete** from the action menu when an integration no longer needs a key.

## API Dashboard

The API Dashboard lists API requests for the account. You can search by URL and see each request's date, status, method, source and path.

![The API Dashboard's API Request History table listing each request's Date, Status, Method and URL, here mostly GET requests with 200, 429 and 422 status codes.](https://docs.astalty.com.au/assets/api-rh.png)

Select a request to see its status, ID, time, IP address, User details, request body and response body. Request and response bodies can contain sensitive account data, so only grant Dashboard access to trusted Admins.

![The API Request History with a request selected, opening a details panel for its URL that lists Status, ID, Time, IP Address, User, User ID and Email, followed by the Response Body and Request Body.](https://docs.astalty.com.au/assets/req-info.png)

Use the request history to investigate an integration error, then compare the request with the [API Reference](https://docs.astalty.com.au/developers/api-reference).

## API Endpoint Dashboard

The [API Endpoint Dashboard](https://api.app.astalty.com.au/docs) is generated from the deployed API. It documents each public operation's path, method, parameters, request body and response schema. Check the deployed reference when building or updating an integration.

![The Astalty API reference on its Overview page, listing endpoint groups such as Invoices, Participants, Plan Managers and Users, the Live Server base URL https://api.app.astalty.com.au and the Bearer Auth security section.](https://docs.astalty.com.au/assets/api-dashboard-and-current-end-points.png)