Create an API key
Create a key for a script or system that reads or writes your organisation's records, limited to what it needs.
Screenshots are retaken from IQ Entities on every release. Updated 14 October 2026.
A nightly export to the finance system, a script that keeps a data warehouse in step with the register: anything that talks to IQ Entities without a person at the keyboard needs an API key. A key works in the organisation it was created in and nowhere else, and carries at most your own permissions there. The question that decides the key is what the script needs to do, because a key that can only read cannot change the register by mistake.
Create the key
Open Settings and choose API Keys, then click Create key. Creating keys needs the permission to manage the organisation's settings.
Give the key a Key name that says what uses it, so whoever reviews the list later knows what revoking it would stop.
Choose Full access to give it all of your current permissions in the organisation, or Limited access and tick only the permissions it needs.
Click Create key, copy the key and store it in the system that will use it. It is shown once only.
Use and look after the key
The key is listed with the permissions it carries, when it was created and when it was last used. Send it as a Bearer token in the Authorization header of each request; API Documentation in Settings has the reference for every endpoint.
Click Revoke to stop a key at once, when the script is retired or the key may have been exposed.
| What the script does | Access to give |
|---|---|
| Reads the register for a report or an export | Limited access, with read permissions only |
| Keeps records up to date from another system | Limited access, with read and write on those records |
| An AI assistant working on your behalf | No key: connect it instead, see Connect Claude to IQ Entities |
Tips from practice
- Create one key per system. Revoking a shared key stops everything that used it.
- A request the key's permissions do not cover is refused, so start with the fewest and add what the script turns out to need.
- Review the list now and then; a key that says never used, or not used for months, is a key to revoke.
- Existing keys stop working, without being deleted, if API access is taken out of your organisation's plan.
Previous: Build on the IQ Entities API.