Skip to main content
The Onlyform Public API authenticates requests with scoped API keys. Keys start with of_live_ and belong to the user who created them.

​
Send an API key

Send the key in the X-API-Key request header:
The API also accepts a bearer token for compatibility, but X-API-Key is the documented and recommended method.
Never put an API key in a URL, client-side bundle, mobile application, public repository, log message, or support ticket.

​
Create a key

  1. Open Profile → API keys.
  2. Select Create API key.
  3. Enter a name that identifies the integration.
  4. Select the minimum scopes the integration needs.
  5. Choose an expiration date when appropriate.
  6. Copy and securely store the secret.
Onlyform shows the complete secret once. The dashboard later displays only its prefix and metadata. You can have up to 20 active, unexpired keys.

​
Scopes

Scopes use the resource:action format. Calling an endpoint without its required scope returns 403 INSUFFICIENT_SCOPE.
Use separate keys for development and production. This limits the impact of a leak and makes rotation easier.

​
Rotate a key

1

Create a replacement

Create a new key with the same minimum scopes as the existing integration.
2

Update your secret store

Deploy the replacement key without revoking the old key yet.
3

Verify traffic

Call GET /v1/me with the replacement key and confirm the integration is using it.
4

Revoke the old key

Revoke the previous key from Profile → API keys. Revocation takes effect immediately.
Expired or revoked keys return 401 INVALID_API_KEY.

​
Key security

  • Store keys in a managed secrets service or encrypted environment configuration.
  • Grant only the scopes an integration needs.
  • Set an expiration for temporary integrations.
  • Rotate keys on a schedule and immediately after suspected exposure.
  • Use the key’s Last used value to identify inactive credentials.

Make your first request

Verify a new key and list your workspaces.