Skip to main content

​
API Keys

API keys are service credentials for your own automation. API key management requires a user token. An API key cannot create, reveal, list, or delete API keys. Open the API Keys tab in Breezy to manage service API keys from the dashboard.

​
Management flow

  1. Authenticate with a user JWT.
  2. POST /integrations/api-keys to create a key.
  3. Store the returned key immediately. It is shown only once and is secret.
  4. Use Authorization: Bearer bzy_live_... for server-to-server requests.
  5. Rotate and delete unused keys with the management endpoints.

​
Creator attribution

Create and list responses identify the principal that created each key. For a customer user, createdBy retains its existing id, email, firstName, and lastName fields. It has no kind field. A key created by impersonating Breezy staff retains those fields with generic values and adds kind and displayName:
The ID identifies the acting staff principal. Personal staff names and email addresses are not returned. staff@breezy.invalid is a compatibility placeholder, not a contact address; do not send email to it. Consumers can use kind: 'staff' and displayName to identify and label staff creators. Existing historical creator IDs are preserved; earlier impersonating actors cannot be reconstructed from user-only attribution records. Keys whose historical user profile is unavailable retain the existing Deleted User representation.

​
Safety expectations

  • Store keys only in a secret manager or equivalent encrypted configuration.
  • Do not log full key values.
  • Prefer one key per integration or automation owner.
  • Delete keys immediately when an integration is retired.