API Keys
creavio's API lets developers build custom integrations with your account. API keys authenticate these connections and give you granular control over what external tools can access.
Creating an API Key
Navigate to Settings > Developer > API Keys and click Create New Key. You'll need to provide:
- Key Name — a descriptive label (e.g., "Zapier Integration" or "Custom Website")
- Scopes — which parts of your account the key can access
- Expiration — optional expiry date for automatic revocation
After creation, your API key is displayed once. Copy it immediately and store it securely. creavio cannot show the full key again.
Available Scopes
Each API key can be limited to specific scopes:
- clients:read — view client information
- clients:write — create and update client records
- bookings:read — view calendar and bookings
- bookings:write — create and modify bookings
- invoices:read — view invoices and payment status
- galleries:read — access gallery images and metadata
Always use the minimum scopes necessary for your integration. A website contact form only needs clients:write, not full account access.
Managing Keys
The API Keys page shows all active keys with their name, scopes, creation date, and last used timestamp. You can:
- Revoke a key instantly if it's compromised
- Regenerate a key to get a new secret while keeping the same name and scopes
- Edit scopes to expand or restrict access
Rate Limits
API requests are limited to 100 requests per minute per key. If you exceed this limit, requests return a 429 status code. For bulk operations, use batch endpoints where available.
Security Best Practices
- Never expose API keys in client-side code or public repositories
- Rotate keys periodically — every 90 days is a good cadence
- Revoke any key you're no longer using