Skip to main content

API Keys & Authentication

Create and manage API keys for programmatic access.

API Keys

API keys authenticate requests to the CrownSync Playbooks REST API and are required for all inbound integrations, SIEM connections, and custom automations. API keys are managed from the Admin section and are scoped to your organisation.

Creating API Keys

To create a new API key:

  1. Navigate to Admin → Integrations
  2. Select the API Keys tab
  3. Click Create API Key
  4. Enter a descriptive name for the key (e.g. "ServiceNow Production" or "Sentinel Ingest")
  5. Select the permissions the key should have
  6. Click Generate

The API key is displayed once upon creation. Copy it immediately and store it securely. For security reasons, the full key cannot be viewed again after you leave the page.

Store Keys Securely

API keys grant access to your organisation's data. Store them in a secure credential manager or secrets vault. Never include API keys in source code, commit them to version control, or share them via email or messaging platforms.

Permissions

When creating an API key, you select which permissions it should have. Available permissions include:

  • Read playbooks— Access playbook content and metadata
  • Create incidents— Create new incidents via the API
  • Read incidents— View incident details and status
  • Update incidents— Modify incident severity, status, and details
  • Log actions— Add action log entries to incidents

Follow the principle of least privilege: grant only the permissions each integration needs. A SIEM integration that only creates incidents should not have read or update access.

Rotating Keys

CrownSync recommends rotating API keys regularly as part of good security hygiene. To rotate a key:

  1. Create a new API key with the same permissions as the existing one
  2. Update your integration or service to use the new key
  3. Verify the integration works with the new key
  4. Revoke the old key

This approach ensures zero downtime during key rotation. There is no built-in automatic rotation; key management is manual to give you full control.

Revoking Keys

To revoke an API key:

  1. Navigate to Admin → Integrations → API Keys
  2. Find the key you want to revoke
  3. Click Revoke
  4. Confirm the revocation

Revocation is immediate. Any requests using the revoked key will receive a 401 Unauthorised response. Revocation is logged in the audit log.

Information

If you suspect an API key has been compromised, revoke it immediately and create a replacement. Check the audit log for any unexpected API activity during the period the key may have been exposed.

Was this page helpful?