An API key carries the permissions of the member who generated it. A member with full access to a solution can create, read, update and delete its records through the API. A member with read-only access can only read them.
Here is the test: could this member make the change in the app? If not, the API refuses it too.
Example: a vendor risk team runs its procurement sync on a dedicated member. That member can edit the Vendors table and read the Contracts table, so the sync can do exactly that and no more.
Plan Availability | All plan types. Every request counts toward the monthly API allowance: 25,000 on Team, 100,000 on Professional, 500,000 on Enterprise, custom on Signature. |
Permissions | Any member generates a key for their own account. The key never grants more than that member has. |
Platform | API |
Related Reading |
What can an API key do?
Member access. | What the API allows. |
Full access to the solution. | Create, read, update and delete records in its tables. |
Read-only access. | Read records only. Any other request returns an error. |
The key follows your role and your solution, table and field permissions in that workspace. The API sees exactly what you see.
Setting up an integration safely
Create a member for the integration, such as "Procurement sync".
Give that member access only to the solutions and tables the integration needs.
Sign in as that member and generate its key.
Paste the key into the integration.
Tip: Do not run integrations on an Administrator account. A leaked Administrator key reaches the whole workspace.
Personal keys and service accounts
Each member has one personal API key. An integration that needs several keys, or a key not tied to a person, uses a service account.
Administrators create the service account and add named credentials: an API key or OAuth client credentials. Each credential can be revoked on its own and can carry an expiry date. See Service Accounts in SmartSuite.
Frequently asked questions
How do I get my API key?
How do I get my API key?
Select your profile icon in the upper right, open My Profile and scroll to API Key. Select the masked value to reveal it, then copy it.
Can an API key change tables or fields?
Can an API key change tables or fields?
Only if its member could do it in the app. Changing a solution's structure needs the Solution Manager permission or the Administrator role.
Why does my request return an error when I can read the records?
Why does my request return an error when I can read the records?
Your access to that solution is read-only. Create, update and delete requests need full access to the solution.
Does an integration need its own paid seat?
Does an integration need its own paid seat?
A personal key acts as its member, so a dedicated member is the safest setup. A service account gives the integration its own identity instead.
Need more help? Ask the SmartSuite Community, where builders, administrators and the SmartSuite team answer questions about building on SmartSuite. For your account, billing or data, select the chat button in the lower-right corner of SmartSuite to reach support.
Last verified 1 Nov 2026.