Skip to main content
Every request needs an API key, sent in the X-API-Key header:

​
Get a Key

Create a key in Studio at Manage → API Keys with New Key. The key is shown once, when you create it, so copy it then and store it somewhere safe, such as your secrets manager. Keys start with squawk_sk_live_. See API Keys for creating, expiring and revoking keys.

​
What a Key Can Reach

A key acts as the person who created it, inside their account:
  • It reaches every campaign and every agent in the account, not only the one you were looking at when you created it.
  • A campaign or agent in any other account answers 403.
  • Keys have no scopes, so you can’t limit one to a single campaign or agent.
  • Changes a key makes, such as replacing an agent’s guidelines or publishing it, are recorded in Audit Logs with the key’s creator as the Actor.
Use one key per integration, so you can revoke one without breaking the others.

​
When a Key Is Refused

A request with no key, or with a key that is unknown, revoked or expired, answers 401. The reply is the same in every case, so it doesn’t say which:
Check that the key is sent in an X-API-Key header, and that it is still listed at Manage → API Keys and hasn’t expired. An expired key can’t be extended: create a new one. Use a key with the endpoints in this reference. Most other SquawkVoice endpoints refuse a key with a 401, which reads like a broken key rather than an endpoint that doesn’t take one.
Keep keys out of browser and mobile code. Anyone who has a key can place calls, and change and publish agents, in your account. If a key leaks, revoke it at Manage → API Keys straight away: it stops working on its next request.