An API key lets another app, or a developer's code, work with your SplashSend account. For example, a booking system could add people, or a till could send in orders. Each key belongs to your account and can only do what you allowed. It also makes a private app, an app of your account's own, whose page shows what the key did. The owner and admins can create keys.

Create a key

  1. Go to Setup → API keys.
  2. On the Public API card, click Create API Key.
  3. Under Key Name, type what it's for, such as “Studio till”.
  4. Under What it can do, choose No, Read or Read & write for each area. For Campaigns, choose No or Write.
  5. Click Create.
  6. Click the copy button beside the key and keep it somewhere safe. SplashSend only shows it once. Then click Done.
Choose what the key can do for each area.
Choose what the key can do for each area.

To build something new with an AI tool, make an app in Apps, under Apps you've made, instead. It gives you a key too, with a brief for your AI tool and a test mode. See Making your own app with AI.

What each area allows

  • People: read your list, and add or update people.
  • Lists: read and create lists, and add or remove the people on them.
  • Events: record things that happen, such as a booking or a sign-up.
  • Orders: send in sales from a shop SplashSend doesn't connect to.
  • Products: keep a catalogue up to date for product blocks in emails.
  • Campaigns: create draft campaigns, which you then design and send yourself. AI assistants use this.
  • Data sets: read your data sets and keep the ones you type in yourself up to date. Columns holding someone's email address also need People access.

Anything that shows who someone is needs People access too: the email address on an order or an event, the names and addresses of the people on a list, and data-set columns holding email addresses.

A new key starts with Read & write for People and Events, and No for everything else. Give a key only what it needs. A key for a sign-up form on another website, for example, only needs People. No key can send a campaign, whatever you choose.

Your keys

The Public API card lists your keys, each with what it can do, the start of the key, when it was created and when it was last used. Only the owner and team admins can see the card, and it shows every key on the account, with who made each one. A key made before you could choose shows Everything. Beside each key's name, Its app opens its app's page, which lists what the key did. Each key you make makes a private app, and an account can have up to 10 private apps.

To change what a key can do, click Its app beside it, then Change beside What it can do. The key keeps working, with the new access.

The Public API card listing two keys, each with what it can do, its app, when it was made and when it was last used.
Each key, with what it can do and its app.

Revoke a key

Click the bin beside the key, then click Revoke. The key stops working straight away, and if it was its app's last key, the app goes too. The owner and team admins can revoke any key on the account. When a team member leaves your team or is removed, or an admin is made a member, the keys they made are revoked, so create keys from a login that will stay.

Limits and safety

  • Each key can make 100 requests a minute.
  • Keep keys out of web pages and shared documents, because anyone who has a key can do whatever it allows. If a key may have been seen by someone else, revoke it and make a new one.
  • A key made under Apps you've made is refused if a web page sends it. Keys made here still work from a web page, because a sign-up form on another website may send one.

For what a developer can do with a key, see Using the API. To use a key with an AI assistant, see Connecting an AI assistant.