How to generate an API Key

Birdie API keys are the credentials that authenticate your requests to the Birdie API, including the Ingestion API. Any organization administrator can create a key directly from the Birdie dashboard, with no request to the Birdie team required.

Follow this guide to generate a new key.

---

How to Generate a New API Key

To create a new key, ensure you are logged into your Birdie account and follow these steps:

1

Navigate to Settings

• Use the sidebar to navigate to your profile icon > Settings.

2

Access the API Key Tab

• From the side navigation menu, select Data Management > API Key, or you can also go directly to the page using this link.

• Click the "New API Key" button.

If your organization already has keys, the "New API Key" button is in the top right corner of the page instead of the center.

3

Generate the Key

• Confirm the creation by clicking "Generate key".

The key is generated and saved automatically, and you will be able to copy it only once. Make sure you have a secure place to store it before continuing.

4

Copy and Store the Key

• Click the copy icon next to the generated key and store it in your secrets manager or password vault.

• Click "Done" to close the dialog.

Once you close this dialog, the key value cannot be retrieved again. If you lose it, you will need to delete the key and generate a new one.

Your new key now appears in the API Key list, identified by its Key ID and creation date. The list shows only these identifiers, never the key value itself.

---

Using Your API Key

Include the key in the Authorization header of every request to the Birdie API, in the form:

Authorization: ApiKey {api-key}

For the full list of endpoints, payload formats and response codes, see the Ingestion API article.

---

Managing and Revoking Keys

• Multiple keys: You can keep several active keys at the same time, for example one per integration, so that revoking one does not interrupt the others.

• Rotating a key: To rotate without downtime, generate the new key first, update your integrations to use it, and only then delete the old one.

Revoking a key: Click the trash icon next to a key in the API Key list to delete it. The change is immediate and cannot be undone. Any request using that key will start returning 401 Unauthorized, so confirm that no active integration still depends on it before removing it.

---

⚠️ Important Security Disclaimers

API keys grant access to your organization's data in Birdie. We recommend the following best practices:

• Treat Keys as Passwords: Store keys in a secrets manager or password vault. Never commit them to source control, hard-code them into applications, or embed them in client-side code.

• Avoid Public Channels: Never share your API keys via email, Slack, or support chat.

• Credential Rotation: Rotate your API keys periodically as part of your organization's standard security hygiene, and immediately whenever a key may have been exposed.

• One Key per Integration: Using a dedicated key for each integration limits the impact of a leak and lets you revoke access to a single system without affecting the others.