# API keys: a help page for owners

## What it is

The API lets other programs work with your CloudOverture data. "API" means a doorway for software. Your website, a tool you already use, or a company system can read and update your customers, contacts, and invoices through it. You control the doorway with **API keys**. Each key has a name, an owner, and a list of what it may do.

## How do I create an API key?

1. Go to **Settings → Developers**.
2. Click **Create key**. Give it a name you will know later, like "Website contact form".
3. Choose what it can do. Give it the least it needs. A key that only reads invoices should not be able to send them.
4. Copy the key when it is shown. This is the only time you see the whole key. Paste it into the tool that needs it.

## How do I connect a company system, like a billing system?

Create the key while you are signed in as the owner. A key stops working when the person who owns it leaves the team. A company system should not stop because one person left.

## How do I see what a key has been doing?

Open **Settings → Developers** and look at the **Request log**. It lists every call made with your keys in the last 14 days. A developer may ask you for a "request ID". You can find it there.

## Common questions

- **Is a key dangerous if it leaks?** A leaked key can only do what you allowed, and only see what its owner can see. Revoke it in Settings → Developers the moment you suspect a leak. Revoking takes effect at once.
- **What happens to keys when someone leaves?** When you deactivate a team member, every key they own stops working at the same moment.
- **Can an AI agent send an invoice without me?** No. An AI agent can read and draft. Sending an invoice or recording a payment waits for your approval. Refunds, payments to vendors, and deleting records are not possible for an agent at all. No setting changes this.
- **Where are the developer docs?** At our docs site, linked from Settings → Developers. Send that link to your developer. It has examples to copy.
- **Can a developer test without touching my real books?** Yes. Ask us for a sandbox when you request API access. A sandbox is a separate company with sample data. Your developer signs in to it with their own email. Its test keys can never reach your real books, and it never emails your customers.
- **Why does every call say API access is off?** API access is turned on per company. Click **Request access** in Settings → Developers, and we will turn it on.

## Examples

- *"Every Monday, my spreadsheet pulls all unpaid invoices."* A key with **Read** on invoices, nothing else.
- *"My website form creates a new customer and a contact."* A key with **Read and write** on accounts and contacts.
- *"Our billing system creates and sends renewal invoices."* A key with **Read and write** on accounts and invoices, plus **Send invoices**, created from the owner's login.