Does the old account API key still work?
It is retired by default. A temporary compatibility setting may allow an existing integration during a transition. Create a scoped API key for each tool rather than relying on that exception.
Help Center
The account API key was replaced by API keys
The single account API key is retired for customers. Create an API key with the permissions your tool needs and choose how long it lasts.
The account API key was replaced by API keys. Each API key carries only the permissions you choose, expires after the number of days you pick, and can be revoked on its own.
Use this guide when
You are looking for the account API key, or a tool stopped working because it still sends one.
Before you start
- Sign in as the account owner in the Personal workspace. Team members cannot manage API keys.
- Check which permissions your plan includes. The API keys page shows every permission, and any that your plan does not include are shown switched off with an Upgrade link.
Steps
- Open Account, then choose API keys. Every key is created, listed and revoked on this page now.
- Choose New key to open Create a key, then give the key a name that says what it is for, for example CRM sync.
- Under Valid for, choose 30, 90, 180 or 365 days. 90 days is the default.
- Under Permissions, tick only what the tool needs, for example Read cards for a tool that reads your cards, or Create and edit cards (saved as drafts you approve) for a tool that prepares cards. Create and manage API keys lists the permission each task needs.
- Choose Create key and copy the key into the tool straight away. It starts with zpk_ and cannot be shown again.
- Send the tool the new key in the same Authorization header it used before, then delete the old account key from its settings.
Store a key as carefully as a password. If one may have leaked, revoke it on the API keys page and create a new key for the tool.
What changed
The old account API key was a single broad credential without per-tool permissions or an expiry date. Its access still depended on the account, plan and enabled API endpoints.
API keys replace it. Each key carries only the permissions you tick, expires on the date you choose, and can be revoked on its own without touching your other tools.
Nothing else about connecting a tool changed. A tool still sends its key in an Authorization header to the same address, so only the key value in its settings is new.
Where your key lives now
The API keys page under Account is where keys are created and managed. It lists active keys first and folds past keys under Past keys.
Each entry shows the characters the key starts with, its permissions and when it was last used. Open View key details and revoke to see when the key was created and when it expires, or to revoke it.
To replace a key, create the new one first, store it in the tool, check that the tool works, and then revoke the old key.
If a tool still sends the account key
The old customer account key is retired by default. An operator may temporarily allow it for an existing integration during a transition, but it is no longer shown or regenerated on the account page. Administrators manage a separate admin API key under Admin, API documentation for the admin API.
Create an API key with the permissions that tool needs, replace the stored key in the tool, and check that it works before you remove the old value from its settings.
Plans and availability
Professional includes the developer API, managed-profile API and MCP connections for AI assistants. Starter includes CSV profile import in the dashboard, but not API or MCP access. Custom plans keep their agreed permissions. If access is temporarily paused, the API keys page shows a pause notice; upgrading does not remove a site-wide pause.
Good ways to use this
- Create one key per tool, so a key can be replaced or revoked without touching the others.
- Give each key the smallest set of permissions that works and the shortest validity that fits how the tool is used.
- Store keys in the tool's secret settings or a password manager, never in a chat, a ticket or a screenshot.
- Remove the account key from a tool as soon as the tool uses an API key, because a key that is no longer needed is still a risk.
Common questions
Can I change the permissions of a key later?
No. The permissions are chosen when the key is created and cannot be edited, so create a new key with the permissions you need and revoke the old one.
Do the addresses my tool uses change?
Existing account API endpoint addresses and the Authorization: Bearer header stay the same. Managed-profile operations use /api/managed-profiles and MCP uses /mcp. They share the key system, but have their own plan permissions and availability controls. The Developer API and AI assistants tabs on the API keys page list the addresses.
If something looks wrong
- For an authentication error, check the error code and whether the tool sends an old account key, an expired or revoked key, or an incorrectly copied value. An account_key_retired response means the tool needs a scoped API key.
- If the API keys menu is missing, switch to your Personal workspace and sign in as the account owner. The page appears on every plan.
- If a permission you need is marked Not in your plan, choose Upgrade next to its area to see the plans that include it.
- A 403 can mean a missing key permission, a plan restriction or an inaccessible resource. Read the error code before replacing a key; permissions on an existing key cannot be edited.
Was this guide helpful?
Still have questions? Contact support and we'll help you out.