Skip to main content
Make a key under Developers → API keys in the dashboard. Only owners and admins see the Developers section. Send the key in the Authorization header:
A missing, malformed or revoked key gets 401 unauthorized.

​
API keys

  • A key is wd_ and 48 hex characters. It is shown once, when you make it. Wiredesk keeps only a hash, so a lost key cannot be shown again. Revoke it and make a new one.
  • A key acts for the whole workspace. It can do what an admin can, except billing and the team.
  • Full access keys can read and change. Read only keys can read everything and get 403 read_only_key for any change.
  • A key works only while the person who made it is still an owner or admin of the workspace. If they leave, or are made an agent, their keys stop working. The keys list marks them Not working.
  • Revoke stops a key on its next request.
  • Changes made with a key appear in the activity log under the person who made it, with the key’s name.
  • Make one key for each tool that connects, so you can revoke one without breaking the others.
Keep keys on your server. A key in a web page or a mobile app can be copied, and the API does not send CORS headers, so browsers cannot call it.

​
Requests without a key

Starting an agent-first onboarding is the one request that takes no key. It answers with a key that works for that trial’s agent only, until the agent is claimed or the trial expires a week later.