API Keys & Authentication
Create and manage API keys for programmatic access.
API Keys
API keys authenticate requests to the CrownSync Playbooks REST API and are required for all inbound integrations, SIEM connections, and custom automations. API keys are managed from the Admin section and are scoped to your organisation.
Creating API Keys
To create a new API key:
- Navigate to Admin → Integrations
- Select the API Keys tab
- Click Create API Key
- Enter a descriptive name for the key (e.g. "ServiceNow Production" or "Sentinel Ingest")
- Select the permissions the key should have
- Click Generate
The API key is displayed once upon creation. Copy it immediately and store it securely. For security reasons, the full key cannot be viewed again after you leave the page.
Store Keys Securely
API keys grant access to your organisation's data. Store them in a secure credential manager or secrets vault. Never include API keys in source code, commit them to version control, or share them via email or messaging platforms.
Permissions
When creating an API key, you select which permissions it should have. Available permissions include:
- Read playbooks— Access playbook content and metadata
- Create incidents— Create new incidents via the API
- Read incidents— View incident details and status
- Update incidents— Modify incident severity, status, and details
- Log actions— Add action log entries to incidents
Follow the principle of least privilege: grant only the permissions each integration needs. A SIEM integration that only creates incidents should not have read or update access.
Rotating Keys
CrownSync recommends rotating API keys regularly as part of good security hygiene. To rotate a key:
- Create a new API key with the same permissions as the existing one
- Update your integration or service to use the new key
- Verify the integration works with the new key
- Revoke the old key
This approach ensures zero downtime during key rotation. There is no built-in automatic rotation; key management is manual to give you full control.
Revoking Keys
To revoke an API key:
- Navigate to Admin → Integrations → API Keys
- Find the key you want to revoke
- Click Revoke
- Confirm the revocation
Revocation is immediate. Any requests using the revoked key will receive a 401 Unauthorised response. Revocation is logged in the audit log.
Information
If you suspect an API key has been compromised, revoke it immediately and create a replacement. Check the audit log for any unexpected API activity during the period the key may have been exposed.
Was this page helpful?