> ## Documentation Index
> Fetch the complete documentation index at: https://boltcall.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage API keys to authenticate your requests to the Boltcall REST API.

API keys authenticate your requests to the Boltcall REST API. Each key carries a set of resource permissions so you can grant only the access a particular integration needs.

<Warning>
  Your full API key is shown **only once** — immediately after creation. Copy it to a secure location before closing the dialog. If you lose it, you must revoke the key and create a new one.
</Warning>

## Create an API key

<Steps>
  <Step title="Open API Keys settings">
    In your dashboard, go to **Settings → API Keys**.
  </Step>

  <Step title="Start a new key">
    Click **Create API Key**.
  </Step>

  <Step title="Name the key">
    Enter a descriptive name that identifies how the key will be used — for example, `Production Backend` or `CRM Integration`.
  </Step>

  <Step title="Set an expiry date (optional)">
    Choose an expiry date if you want the key to automatically deactivate after a set period. Leave blank for no expiry.
  </Step>

  <Step title="Choose permissions">
    Select the resources and permission levels this key needs. You must grant at least one permission.
  </Step>

  <Step title="Copy your key">
    Click **Create Key**. Copy the full key from the confirmation dialog — it will not be shown again.
  </Step>
</Steps>

## Resource permissions

Each API key is scoped to specific resources. You can grant `read`, `write`, or both permissions per resource.

| Resource         | Description                               |
| ---------------- | ----------------------------------------- |
| `calls`          | Read/write access to call history         |
| `leads`          | Read/write access to lead data            |
| `agents`         | Read/write access to agent configuration  |
| `analytics`      | Read access to analytics data             |
| `contacts`       | Read/write access to contacts             |
| `knowledge_base` | Read/write access to the knowledge base   |
| `integrations`   | Read/write access to integration settings |

**`read`** — allows GET requests to list and retrieve records for that resource.

**`write`** — allows POST, PATCH, and DELETE requests to create, modify, and remove records for that resource. Write access does not automatically include read; grant both if needed.

<Info>
  The `analytics` resource supports `read` only. Write access is not available for analytics data.
</Info>

## Use a key in API requests

Include your API key as a Bearer token in the `Authorization` header of every request:

```http theme={null}
Authorization: Bearer YOUR_API_KEY
```

For example, using curl:

```bash theme={null}
curl https://api.boltcall.org/v1/leads \
  -H "Authorization: Bearer YOUR_API_KEY"
```

See the [API authentication guide](/api/authentication) for full details on request formatting and error codes.

## Revoke a key

To permanently deactivate a key:

<Steps>
  <Step title="Open API Keys settings">
    Go to **Settings → API Keys**.
  </Step>

  <Step title="Revoke the key">
    Find the key in the **Active Keys** list and click the trash icon on the right.
  </Step>

  <Step title="Confirm">
    Click **Revoke Key** in the confirmation dialog. Any application using this key loses access immediately.
  </Step>
</Steps>

Revoked keys appear in the **Revoked / Expired** section for audit purposes and cannot be reactivated.

## Security best practices

* **Never share keys publicly.** Do not commit API keys to source control or expose them in client-side JavaScript.
* **Use minimal permissions.** Grant only the resources and permission levels each integration actually requires.
* **Set an expiry date** for keys used in short-term integrations or shared environments.
* **Rotate keys regularly.** Revoke and replace keys periodically, especially after team member changes.
* **Monitor usage.** Each key displays usage counts for the last 24 hours, 7 days, and 30 days — review these if you suspect unauthorized access.

## Rate limits

Each API key has a rate limit of **60 requests per minute** by default. If your integration requires a higher limit, contact [support@boltcall.ai](mailto:support@boltcall.ai). See [Rate limits](/api/rate-limits) for more detail.