Your API key is created in your profile: click your profile icon in the upper-right corner, open My Profile, scroll to API Key and click Generate New Key. The key carries your own permissions; if it is ever exposed, click Destroy Token, generate a new one and update every integration.
Plan Availability | All plan types. |
Permissions | Any member, for their own account. The key acts with that member's role and permissions. |
Platform | Web |
Related Reading |
What is an API key?
An API key authenticates requests to the SmartSuite REST API. It is specific to one member and grants exactly that member's permissions, so an integration that uses it sees and changes only what the member could.
Important: Treat the key like a password. Do not share it; regenerate it if it is exposed.
How do I generate a key?
Sign in as the member whose permissions the integration should have.
Click your profile icon in the upper-right corner and select My Profile.
Scroll to the API Key section.
Click Generate New Key, then copy the key into your integration.
How do I revoke and replace a key?
Sign in as the member whose key is affected.
Open My Profile and scroll to API Key.
Click Destroy Token. The old key stops working at once.
Click Generate New Key.
Paste the new key into every integration that used the old one.
Important: A destroyed key is invalid immediately. Integrations that still use it fail until they are updated.
How do I keep the key safe?
Use a member with only the permissions the integration needs.
Review and regenerate keys regularly.
Revoke a key at once if you see activity you do not recognize.
Give an integration its own identity with a Service Account; see Service Accounts in SmartSuite.
Frequently asked questions
The first question came from three conversations this month.
Where do I find my API key?
Where do I find my API key?
Click your profile icon in the upper right, open My Profile and scroll to the API Key section. Click the masked value to reveal it, then copy it.
Which permissions does my key have?
Which permissions does my key have?
Exactly yours. The key mirrors your role and your solution, table and field permissions, so it can do nothing you could not do in the app.
Does an integration need its own paid seat?
Does an integration need its own paid seat?
The key belongs to a member, so the integration acts as that member. A dedicated member with minimal permissions is the safest setup; Service Accounts give integrations their own identity.
Last verified 22 Oct 2026.