API keys

An API key lets your own scripts and tools, such as Zapier or a nightly sync, read your Hey Customer data through the API.

How it works

A key acts as you. It sees exactly the records you can see in Hey Customer, follows the same permissions, and belongs to one organization. Keys can only read for now.

To connect Claude, ChatGPT or another AI assistant, you usually don't need a key: sign in from the assistant instead, as described in Connect Claude, ChatGPT and other AI assistants. Keys are for tools that can't sign in.

Your keys live under Profile then API & connected apps.

Create a key

1. Go to Profile then API & connected apps.
2. Select New key.
3. Name the key after what will use it, such as Nightly sync script.
4. Choose when it expires: 30 days (the default), 90 days, 1 year, Custom date or Never.
5. Select Create key.

If you choose Never, you'll see a warning: a key that never expires stays valid until someone revokes it. Pick a date unless the key runs a long-lived integration you keep an eye on.

Copy your new key

Your new key appears once, right after you create it. Select Copy key, store it in your password manager or your tool's secret settings, then select I've saved my key.

You can't see the key again after you close this window or reload the page. If you lose it, revoke it and create a new one.

Your tool sends the key in an Authorization: Bearer header. The API reference, with examples you can try, is at developers.heycustomer.com.

Keep track of your keys

The table lists each key's name, its access, the first and last few characters of the key so you can tell them apart, when it was created, when it was last used, and when it expires.

• Expires in a number of days appears when a key expires within 14 days.
• No expiration marks keys set to never expire.
• Expired marks a key that has expired and no longer works.

We email you 7 days before a key expires, and again once it has. Keys can't be extended, so create a new key and switch your tool over before the old one runs out.

Revoke a key

1. Select Revoke next to the key.
2. Check the confirmation, which shows when the key was last used, and select Revoke key.

The key stops working immediately, and anything using it loses access. This can't be undone.

See every key in your organization

Administrators can see and revoke everyone's keys, and disconnect everyone's AI assistants, under Configurations then Security. The same page keeps an audit log of the last 50 times someone created, revoked or connected access, and of keys that expired.

Opening it needs both the Access all configurations and Manage integrations permissions. The Manage API access button on the Integrations page leads here too.

Good to know

• Creating keys needs the API keys & AI assistants permission. While it's turned off, your keys stop working; they work again when it's turned back on.
• You can always revoke your own keys, whatever your permissions.
• A key belongs to one organization. If you work in more than one, create a key in each.
• Keys can only read for now.
• Each key can make up to 120 requests a minute.
• Keys created before October 9, 2026 show only their first few characters in the table.
• Treat a key like a password: keep it out of code you share, and create a separate key for each tool so you can revoke one without breaking the others.