How to Create an API Key — and How to Grant API Key Permissions to Other Users

Overview

API keys let external tools — like Power BI, custom dashboards, or third-party integrations — connect to your Xenia workspace and pull operational data. By default, only Workspace Owners can create API keys. This article explains how to create one and how to delegate that capability to other roles.

Who Can Create API Keys (Default)

By default, the Manage API Access Keys permission is granted to Workspace Owners only.

Admins and other roles do not have this capability unless it's explicitly granted. See the section below on delegating the permission.

How to Create an API Key

1. Go to Settings → Public Integrations
2. Click Create API Key (or the equivalent button)
3. Fill in the key details:

Client Key (required)
A human-readable identifier of your choosing — letters, numbers, and hyphens, minimum 5 characters. This is what you'll send as the x-client-key header in API calls. Choose something descriptive: powerbi-reporting, zapier-integration, analytics-dashboard.

Default User (required)
Select which Xenia user this API key will act as. Every API call made with this key behaves as if that user made it — the data it can access, the reports it can run, and the endpoints it can reach are all governed by that user's role and location membership.

4. Click Create
5. Xenia generates the client secret and displays it once only

Copy the client secret immediately and store it in a secure location — a password manager or your team's secrets vault. It cannot be retrieved after this screen is closed. If lost, you must create a new key.

Your Two Credentials

After creation you have:

Both headers are required on every API call.

Managing Existing Keys

In Settings → Public Integrations, you can see all API keys created in your workspace:

• View the client key name, the default user, and when it was created
• Deactivate a key to immediately revoke access — any tool using that key will receive a 401 error on its next call
• Delete a key permanently

If a secret is ever exposed or compromised, deactivate or delete the key immediately and create a new one.

How to Delegate API Key Creation to Other Roles

By default only Owners can manage API keys. To allow Admins or other roles to create and manage keys:

1. Go to Settings → Users & Teams → Roles
2. Click the role you want to grant the permission to (e.g. Admin)
3. Find the Manage API Access Keys permission toggle
4. Toggle it ON
5. Save

Users with this role can now access Settings → Public Integrations and create, view, and deactivate API keys in the workspace.

Recommended Setup for Integration Keys

Create a dedicated integration user rather than using a personal account as the API key's default user. Benefits:

• The integration doesn't break when an employee leaves
• You can grant that user the exact permissions needed without affecting anyone's personal account
• The user's location membership determines which data the API can access — assign it to all locations for complete data visibility

Example setup for Power BI:

• Create user: powerbi-integration@yourcompany.com
• Role: Admin or a custom role with View Reporting, View Tasks, and Advanced Dashboards capabilities
• Location membership: all locations
• Create the API key with this user as the default user

Frequently Asked Questions

Q: Can one API key access multiple workspaces?

No. Each API key is permanently tied to the workspace it was created in and can only read data from that workspace. Create separate keys for separate workspaces.

Q: What happens if the default user's role or location access changes?

The API key immediately reflects the change. If the default user loses access to a location, API calls using that key will no longer return data from that location. Always use a stable dedicated integration user.

Q: How many API keys can I create?

There's no enforced limit. Create separate keys for separate integrations so you can deactivate one without affecting others.

Q: Can I rotate a key's secret without deactivating it?

No — the secret is generated once at creation and cannot be regenerated on an existing key. To rotate, create a new key, update the secret in your integration, then deactivate the old key.

For help enabling the Public API on your workspace or questions about access, contact your Xenia representative or reach out at support@xenia.team.