Clientish Documents
Step-by-step guides for every module, from your first workspace to proposals, billing, support and automation.
Create an API Key
Let your own tools read your workspace: create a read-only key, choose what it may read, and make your first request.
An API key lets your own tools read your workspace: a reporting dashboard, a Zapier action or a script. Keys are read-only. They can read what you allow, and they can never change anything.
Overview
This guide shows how to create a key, choose what it may read, make your first request, and manage the key afterwards. For every endpoint and field, see the API reference.
Who Can Access
Only the workspace owner can create and manage API keys, under Webhooks & API in the sidebar.
Step-by-Step Guide
Open API keys
In the sidebar, click Webhooks & API and open the API keys tab. Click Create API key. API reference opens the full list of endpoints.
Name it and choose permissions
Give the key a name that says what uses it, such as “Zapier: read clients”. For each area, choose None or Read. Keys are read-only for now.
Set limits and create the key
- Expires: the key stops working at the end of that day. Leave empty for no expiry.
- Requests per minute: between 1 and 1,000 (default 120).
- Allowed addresses: optional IP addresses, one per line.
Click Create key.
Copy the key
The key is shown only once. Click Copy and store it somewhere safe, then click I have copied it. If you lose it, create a new key.
Make your first request
Send the key as a Bearer token. For example, this lists five clients:
Manage the key
Click the eye icon on a key’s row to see its permissions, requests in the last 7 days, refused requests and the last address it was used from. Edit changes its permissions and limits. Revoke switches it off immediately.
What You Can Read
All requests go to https://clientish.io/api/v1. A key can read /workspace, /clients, /orders, /invoices, /tickets, /services, /leads, /team, /reports/revenue and /search, but only the areas you gave it permission for. Every request is logged on the key.
Tips & Best Practices
Create one key per tool and give it only the permissions it needs. If one tool is compromised, revoke just that key.
Common Issues
Requests are refused: the key may not have permission for that area, it may be past its expiry date, over its rate limit, or used from an address that isn’t allowed. Open the key to see its refused requests.