Settings

API keys

Issue keys for the public lead and appointment API. Use these when you want to POST leads or appointments to InforceDesk from your own backend without relying on browser-based form submission. Owner-only access.

Quick answers
Do I need an API key for my marketing site's form?
Not necessarily. If your form posts from a domain registered in the public_domain field on Settings → Workspace, the system identifies your workspace by Origin header. API keys are for backend-to-backend calls (your CRM integration, your custom forms hosted elsewhere, your Zapier-style automations).
Help, I lost my API key!
Keys are shown exactly once on creation. We store only a hash — there's no "show key again" feature. Revoke the lost one (which makes it unusable) and create a new one. Update wherever the old key was wired in.
How do I rotate a key?
Create a new key, swap your backend over to use it, then revoke the old key once you've confirmed traffic is flowing on the new one. Revoking is permanent — there's no un-revoke.
What does "Last used" tell me?
When the key was last seen in a request. Useful for identifying stale keys that nothing's using anymore. Keys that haven't been used in 180+ days are flagged during quarterly access reviews.

Creating a key

Click + New API key, give it a descriptive name (e.g., "Production marketing site"), save. The raw key appears in a box at the top of the page on next load — copy it immediately. Once you leave the page, the raw value is gone forever. Only the prefix (the first 12 chars including idk_) stays visible afterward for identification.

Using a key

Pass it as a header on your POST request: 

Authorization: Bearer idk_a1b2c3d4...

or 

X-Workspace-Key: idk_a1b2c3d4...

Either header works. The system finds your workspace by hashing the key and looking it up. Requests with a valid key skip the bot-protection checks (honeypot, Turnstile) that anonymous requests go through, and share a fair per-workspace rate-limit bucket (600/hour by default).

Revoking

Click Revoke on any row. The key stops working immediately. Revoked keys stay in the list for audit-trail purposes but can't be un-revoked — create a new one if you need to put the endpoint back into service.

What you can do with the API

Three endpoints: POST /api/leads creates or updates leads, POST /api/subscribe adds someone to your subscriber list, POST /api/appointments books an appointment. Full payload reference is on Settings → API docs (owner-of-any-workspace inline gate).