An API key is a unique code that Document360 generates to allow external applications to communicate with your knowledge base securely. You can create and manage API keys directly from the Document360 portal to enable integrations with analytics tools, automation platforms, or any third-party service that supports the Document360 API.
When to use API keys
Use API keys when you need to:
- Integrate with external tools — Connect Document360 with analytics platforms, CRMs, or automation tools that need to read or write knowledge base data.
- Automate content workflows — Use POST or PUT keys to programmatically create or update articles without logging into the portal.
- Restrict operation types — Issue separate keys per integration, each scoped to only the HTTP methods that integration requires (for example, a read-only GET key for a reporting dashboard).
- Manage media asset access — Control how long signed URLs for drive assets remain valid when accessed via the API in private or mixed projects.
Before you begin
Confirm the HTTP methods your integration requires (GET, POST, PUT, DELETE) before creating the key.
API keys page
The API keys page is the central interface for viewing, creating, editing, and deleting keys.
The page contains the following elements:
| Element | Description |
|---|---|
| Name | The label assigned to each API key for easy identification. |
| Key | The generated key value. Click the () Copy icon to copy it to your clipboard. |
| Allowed methods | The HTTP methods enabled for the key (GET, POST, PUT, DELETE). |
| Edit () | Hover over a key and click the Edit icon to modify its allowed methods. |
| Delete () | Hover over a key and click the Delete icon to permanently remove it. |
| Keys usage | Shows how many keys are in use out of the total allowed (for example, "6/8 keys created"). |
| Create API key | Button to generate a new key. |
Document360 displays the number of API keys created but does not track where they are used or which endpoints they are associated with.
How to create an API key
- Navigate to Settings () > Knowledge base portal in the left navigation bar.
- In the left navigation pane, select API keys.
The API keys page displays any existing keys. - Click Create API key. Select API v2 for creating legacy API keys with unrestricted access.
The Add API token dialog appears. - Enter a name for the key in the Name field.
- Select one or more HTTP methods to allow for this key:
- Expand the Advanced dropdown and, in the Access validity limit for drive assets field, select the expiry duration for media asset access (15 minutes to 36 hours).
- Click Add.
The new API key is created and appears in the key list.
Labels are used internally within the Knowledge base portal and are not supported in API endpoints. Tags associated with articles and category pages can be retrieved via the API. Refer to the API documentation for more details.
Best practices
- One key per integration — Issue a dedicated key for each external application so you can revoke access selectively without affecting other integrations.
- Apply the principle of least privilege — Only enable the HTTP methods an integration actually needs. A reporting tool needs GET only; avoid issuing POST or DELETE unless required.
- Review keys periodically — Delete keys that are no longer in use to prevent unauthorized access.
- Label keys clearly — Use descriptive names (for example, "Analytics - Read Only" or "CMS Sync - Write") so keys are easy to identify and audit later.
- Adjust drive asset validity for your use case — For short-lived API calls, keep the default 15-minute validity. For batch jobs or longer workflows, extend the duration to avoid broken asset links mid-process.
FAQ
Can we generate multiple API keys for the same HTTP methods in Document360?
Yes, Document360 allows you to create multiple API keys with the same HTTP methods. This is useful when managing integrations across different applications — each application can have its own dedicated key for security and independent management.
Can I restrict the scope of an API key to specific articles or categories?
No, it is not possible to restrict a key to specific articles or categories. You can, however, control which operations the key can perform by selecting only the required HTTP methods (GET, PUT, POST, or DELETE) when creating or editing the key.
How can I increase the drive asset access validity for private and mixed projects?
You can configure the asset access validity period within the API key settings:
- Go to the Knowledge base portal > API keys.
- Edit an existing key or create a new one to open the API key dialog.
- Expand the Advanced dropdown and select the desired access validity limit.
The default validity is 15 minutes. You can extend it up to a maximum of 36 hours.