Developer API
API keys: create, store, rotate and revoke
How Silux Call API keys work, where to keep them safe, how to change a key without downtime, and what to do if one is exposed.
Which plans include it
Included on Plus and above. On Free Trial, Entry you can add it on its own at £2.50 a month from Features & add-ons.
What it means
An API key is a long secret, starting sk_live_, that proves a request comes from your account. Anyone who has it can start calls and read your call history and recordings, so treat it like a password.
What it does
- Each key belongs to one account and works only for that account.
- The full key is shown once, when you create it. We keep only a scrambled copy (a SHA-256 hash), so nobody at Silux Call can read it back.
- The API page shows each key's name, its first characters, when it was created and when it was last used.
- Revoking a key stops it working immediately.
Every part of the page
- Key name
- Up to 60 characters, for example "Our CRM" or "Booking system".
- Key prefix
- The first 12 characters, shown so you can tell keys apart. The rest is never shown again.
- Limit of 10
- An account can have up to 10 active keys. Revoke old ones to make room.
How to use it
Create a key
- Open API in the dashboard menu.
- Type a name and press Create key.
- Copy the key from the yellow box, store it, then press "I have copied it".
Store a key safely
- Cloudflare Workers: run "wrangler secret put SILUX_API_KEY" and paste the key. Read it in code as env.SILUX_API_KEY.
- Node, PHP or Python servers: put it in an environment variable or your host's secrets manager, not in your code files.
- Google Apps Script: Project Settings → Script Properties → add SILUX_API_KEY.
- Never commit a key to GitHub or any shared repository.
Change a key with no gap (rotation)
- Create a new key with a name such as "Our CRM 2".
- Put the new key into your system and check a test call works.
- Revoke the old key on the API page.
If a key is exposed
- Revoke it on the API page straight away. It stops working at once.
- Create a new key and put it into your system.
- Check your call history (Call Records) for calls you do not recognise, and tell our support team if you find any.
Recommended settings
- ★One key per system, named after it.
- ★Check "Last used" every few months and revoke keys that are no longer used.
- ★Only account admins can create or revoke keys; keep the number of admins small.
Abbreviations on this page
- API key
- A secret password that lets one piece of software use another. Treat it like a password.
- Example: Treat an API key like a password: anyone with it can use your account's API.
Questions
I lost my key. Can you send it to me?+
No. We only keep a scrambled copy, so nobody can read it back. Revoke the lost key and create a new one.
Can I put the key in my web page so the browser calls the API?+
No. Anyone could copy it from the page. Your page should ask your own server, and your server calls the API with the key. See "Add a Call button to your own CRM".
Do keys expire?+
No. A key works until you revoke it.
Who can see keys?+
Only account admins see the key list, and even they only see the first characters after creation.