API keys
API key concept
API keys allow programmatic access to your workspace data.
Why it matters
- Integrate with external tools.
- Control access through scopes.
How it connects
- Each key has read and write scopes.
- Keys are tied to the workspace.
- Allowed hostnames can limit browser usage.
Treat API keys like passwords.
Create an API key
Create a key for integrations and automation.
Where to find it
- Dashboard → Integrations → API Keys
Steps
- Open API Keys.
- Select New key.
- Choose scopes.
- Add allowed hostnames if needed.
- Create and copy the key.
Notes
- You may only see the key value once.
- Store it securely.
API key scopes explained
Scopes control what an API key can access.
Scope types
- Read: view data
- Write: create or update data
Best practice
- Grant only the scopes you need.
- Use separate keys per integration.
Allowed hostnames configuration
Limit browser usage by restricting where a key can be used.
How it works
- Hoko checks the Origin or Referer hostname when present.
- Requests without those headers are not filtered by hostname.
- Leave the list empty to allow any hostname.
Examples
example.comapi.example.com*.example.com
Update API key settings
Adjust the name, scopes, and allowed hostnames.
Where to find it
- Dashboard → Integrations → API Keys
Steps
- Open API Keys.
- Select the key.
- Update the fields.
- Save changes.
Revoke an API key
Revoke a key to stop its access immediately.
Where to find it
- Dashboard → Integrations → API Keys
Steps
- Open API Keys.
- Select the key.
- Choose Revoke.
- Confirm the action.
Revoking a key will break integrations using it.
Troubleshooting
Use these fixes when API key actions fail.
Failed to create API key
- Check required scopes.
- Retry after refreshing.
Missing required scopes
- Select at least one scope.
Invalid API key
- Verify you copied the full key.
- Generate a new key if needed.
- Check allowed hostnames when calling from a browser.
Hostname blocked
- Ensure the request Origin or Referer matches an allowed hostname.
- Add the hostname to the allowlist and try again.
API key revoked
- Create a new key and update your integration.