API keys

An API key is a unique code that Document360 generates to allow external applications to communicate with your knowledge base securely. You can create and manage API keys directly from the Document360 portal to enable integrations with analytics tools, automation platforms, or any third-party service that supports the Document360 API. It's the current, recommended way to authenticate. But, if you're looking for the older, project-wide credential, see API tokens (v2).

When to use API keys

Use API keys when you need to:

• Integrate with external tools — Connect Document360 with analytics platforms, CRMs, or automation tools that need to read or write knowledge base data.
• Automate content workflows — Use POST or PUT keys to programmatically create or update articles without logging into the portal.
• Restrict operation types — Issue separate keys per integration, each scoped to only the HTTP methods that integration requires (for example, a read-only GET key for a reporting dashboard).
• Manage media asset access — Control how long signed URLs for drive assets remain valid when accessed via the API in private or mixed projects.

Before you begin

Before you create the key, decide:

• The portal role it needs (what API operations it may perform).
• The content role it needs (what it may do to the content it can reach).
• The content-access scope - the whole project, or specific workspaces/languages/categories.
• Whether it should expire.
  You can change a key's role and content scope later from its Edit dialog, so this isn't a one-shot decision. But get it as close to right as you can up front, since editing a key's scope changes what any integration already using its secret can do, immediately and without warning to that integration.

API keys page

The API keys page is the central interface for viewing, creating, editing, and deleting keys.

Document360 shows how many keys you've created against your plan's quota, but doesn't track where a key is used or which endpoints it's called against.

Creating an API key

1. Navigate to Settings () > Knowledge base portal > API keys.
2. Click Create API key.
3. Enter a name for the key.
4. Choose the portal role the key should carry.
5. Choose the content role the key should carry, and if it's not "None," choose its content-access scope — the entire project, or specific workspaces/languages, or specific categories.
6. Optionally, set an expiry date. Leave it as "Never" for a key that doesn't expire.
7. Optionally, expand Advanced to set the Access validity limit for drive assets (15 minutes to 36 hours) — this controls how long signed drive-asset URLs stay valid when this key is used, separately from the key's own expiry.
8. Click Generate key. Copy the secret now - it's shown only once and can't be retrieved again.

Sending an API key

GET /v3/projects/{projectId}/articles
X-API-Key: d360_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Also accepted as Authorization: Bearer d360_sk_..., so a client that already has a Bearer-header code path can reuse it unchanged.

Security properties

• Your secret is shown only once, right when you create the key. After that, Document360 stores only a hash of it, so it can't be recovered from the portal. If you lose it, you'll need to create a new key.
• Each key can still be identified by a masked value showing its last 4 characters, so you can tell keys apart without exposing anything usable as a credential.
• Disable immediately stops a key from authenticating, but doesn't delete it. You can re-enable it again at any time. Delete removes the key for good, and this can't be undone.
• Document360 tracks when each key was last used, so you can find and retire keys that nobody's calling anymore.
• A key's role and content access aren't locked in once it's created. Open its Edit dialog whenever you need to change them. You don't have to delete and recreate a key just to adjust its scope.
• Your plan's active-key quota is shared across API keys and API tokens. Disabling a key does not free up a slot. Only deleting one does.

Two portal permissions control who can do what here. View API keys lets someone list and inspect keys, but never see the secrets. Manage API keys lets someone create, edit, enable or disable, and delete keys.

Rate limits

API keys get separate read and write rate-limit buckets, so a read-heavy job can't exhaust the allowance a write job needs. Successful responses carry X-RateLimit-Limit and X-RateLimit-Remaining; a breach returns 429. Check these headers for your actual limit — it's set per plan.

Best practices

• One key per integration, so you can disable or delete one without affecting others.
• Apply least privilege — grant only the portal role, content role, and content scope the integration actually needs.
• Set an expiry where practical, especially for short-lived or trial integrations.
• Review keys periodically and retire ones that are no longer used.
• Label keys clearly — e.g., "Analytics – Read Only," "CMS Sync – Write."
• Use Edit, not recreate, when scope needs to change. If you do need a brand-new secret — for example, after a suspected leak — create the replacement key before deleting the old one, so the integration isn't interrupted in between.

FAQ

API tokens (v2)

An API token is Document360's original credential — a single, project-wide token restricted only by HTTP method, with no role or content scoping. It still works, and existing integrations built on it aren't affected by anything above. For any new integration, use an API key instead (see above).

How to create an API token

1. Navigate to Settings () > Knowledge base portal > API keys.
2. On the API keys page, click Create API key and choose API v2 — Legacy API keys with unrestricted access (we recommend migrating to v3) from the dropdown.
   The Add API token dialog appears.
3. Enter a name for the token.
4. Select one or more HTTP methods to allow: GET, POST, PUT, DELETE.
5. Optionally, expand Advanced and set the access validity limit for drive assets (15 minutes to 36 hours).
6. Click Add.

Sending an API token

The token is sent the same way an API key is — as a header on each request. Unlike a key, it's visible in the portal any time after creation.

FAQ