API keys

API key concept

API keys allow programmatic access to your workspace data.

Why it matters

  • Integrate with external tools.
  • Control access through scopes.

How it connects

  • Each key has read and write scopes.
  • Keys are tied to the workspace.
  • Allowed hostnames can limit browser usage.

Treat API keys like passwords.

Create an API key

Create a key for integrations and automation.

Where to find it

  • Dashboard → Integrations → API Keys

Steps

  1. Open API Keys.
  2. Select New key.
  3. Choose scopes.
  4. Add allowed hostnames if needed.
  5. Create and copy the key.

Notes

  • You may only see the key value once.
  • Store it securely.

API key scopes explained

Scopes control what an API key can access.

Scope types

  • Read: view data
  • Write: create or update data

Best practice

  • Grant only the scopes you need.
  • Use separate keys per integration.

Allowed hostnames configuration

Limit browser usage by restricting where a key can be used.

How it works

  • Hoko checks the Origin or Referer hostname when present.
  • Requests without those headers are not filtered by hostname.
  • Leave the list empty to allow any hostname.

Examples

  • example.com
  • api.example.com
  • *.example.com

Update API key settings

Adjust the name, scopes, and allowed hostnames.

Where to find it

  • Dashboard → Integrations → API Keys

Steps

  1. Open API Keys.
  2. Select the key.
  3. Update the fields.
  4. Save changes.

Revoke an API key

Revoke a key to stop its access immediately.

Where to find it

  • Dashboard → Integrations → API Keys

Steps

  1. Open API Keys.
  2. Select the key.
  3. Choose Revoke.
  4. Confirm the action.

Revoking a key will break integrations using it.

Troubleshooting

Use these fixes when API key actions fail.

Failed to create API key

  • Check required scopes.
  • Retry after refreshing.

Missing required scopes

  • Select at least one scope.

Invalid API key

  • Verify you copied the full key.
  • Generate a new key if needed.
  • Check allowed hostnames when calling from a browser.

Hostname blocked

  • Ensure the request Origin or Referer matches an allowed hostname.
  • Add the hostname to the allowlist and try again.

API key revoked

  • Create a new key and update your integration.