API keys
Create and manage API keys that give agents and external tools programmatic access to your CommSync account.
API keys let you authenticate against the CommSync MCP server and the REST API for webhook management, without a browser session. Each key ties to the user who created it — that user's data and org role scope every operation it performs.
Connecting Claude, ChatGPT, Codex, or Cursor?
Use Connect AI apps instead. The app signs you in with OAuth, so you do not copy a key. An API key is the right tool for scripts, servers, and clients that cannot run a sign-in.
Key format
Every API key uses the prefix csk_ followed by 48 hex characters:
csk_a3f8d2e1b7c94f056e...CommSync shows the raw key once, at creation. CommSync stores only a SHA-256 hash of the key, so no one can ever recover the plaintext. If you lose a key, delete it and create a new one.
Save your key immediately
Copy the key as soon as it appears. Once you dismiss the creation dialog, CommSync cannot show it again. Store it in a secrets manager or environment variable — never in source code or committed to a repository.
How to create a key
Open Settings → API Keys
Navigate to Settings → API Keys in the CommSync web app.
Click New key
Give the key a descriptive name — for example, the agent or service that will use it. Names help you identify which key to revoke if credentials leak.
Choose its channel access
All channels (the default) follows your live access, and that includes lines you connect later. Specific lines restricts the key to the email addresses and phone numbers you pick — see Channel-scoped keys. You can change this any time; it never needs a new key.
Choose its security details
Full (the default) lets the key read your account security mail as you see it. Redacted keeps the event and the time, and hides the service and the code — see Security details. Then click Create key.
Copy and store the secret
CommSync shows the full csk_... key once. Copy it to your secrets
manager (an environment variable, AWS Secrets Manager, or a .env file
that you do not commit to source control).
How to use a key
Pass the key in the Authorization header as a Bearer token for every request:
Authorization: Bearer csk_your_api_key_herecurl -X POST "$COMMSYNC_API/api/mcp" \
-H "Authorization: Bearer $COMMSYNC_KEY" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Scope and permissions
A key inherits the permissions of the user who created it:
- CommSync executes all MCP tool calls as that user.
- The user's org role (OWNER, ADMIN, or MEMBER) and channel memberships apply to every tool call.
- A key created by a MEMBER cannot call OWNER-only tools.
- No key can carry more permission than the user who created it holds.
A lead who acts as a teammate cannot see or manage the keys of that teammate. Neither can CommSync support.
On top of that, each key carries its own channel access: full
(All channels) or fine-tuned to Specific lines. A line-scoped key can only
read, send, and act on the chosen email addresses and phone numbers. The
server intersects your live access with the key's allowlist on every
request. This means the key can never see more than you can, and never
more than its scope allows. To change the scope, click the key in
Settings → API Keys, then click Save. The change applies at once, and
the key stays the same.
See Roles & permissions for the full permission model and MCP server for the per-tool gate breakdown.
How to revoke a key
In Settings → API Keys, click the key, then click Revoke key at the
bottom. You can also right-click the key and choose Revoke key.
CommSync deletes the key immediately — any in-flight requests that use it
will start to receive 401 Unauthorized responses.
There is no automatic key expiry or scheduled rotation. Treat a leaked key the same way you would a leaked password: revoke it immediately and issue a new one.
Next steps
Use your API key to call the MCP server or to register a webhook endpoint for push-based event delivery.