Skip to main content
The Introw API uses customer API keys. Each key belongs to one Introw organisation and can only access data in that organisation. Every plan includes API access with a free monthly allowance of API credits. You do not need an add-on to create a key, and nothing has to be bought before your first call.

​
Create an API key

  1. In Introw, go to Settings > Developers > API keys.
  2. Click Create API key.
  3. Enter a descriptive name, such as Production data sync.
  4. Select the scopes your integration needs.
  5. Click Create and copy the API key.
Store the key immediately. Introw only shows the full key once.

​
Authenticate a request

Send the API key in the x-api-key header.
Do not send API keys as query parameters. Do not expose API keys in frontend code, browser extensions, public repositories, logs, or analytics tools.

​
Scopes

Scopes limit what an API key can do. Give each key the smallest set of scopes required for the integration. If a request uses a valid API key but the key does not include the required scope, the API returns 403 Forbidden.

​
Organisation scoping

API keys are tied to the Introw organisation where they are created. You do not need to send an organisation ID in requests. Introw resolves the organisation from the authenticated API key and applies that boundary to every endpoint.

​
Rate limits

API keys are limited to 120 requests per minute, counted in a fixed one-minute window. Every response carries the current budget: Going over returns 429 with RATE_LIMIT_EXCEEDED. For bulk runs such as a backfill or a migration, submit sequentially with a small delay, watch the remaining header, and retry a 429 once the current minute rolls over. You have two budgets to respect, and they are reported the same way. Alongside the per-minute pair, every metered response carries your monthly API credit budget: The credit headers are absent when the request was not metered, or when your allowance is unlimited. A rate limit is not the same as a spent API credit allowance. A 429 clears within the minute, so retrying is right. A 402 does not clear until your credits reset, so retrying it will never succeed.

​
Rotate an API key

Rotate API keys on a regular schedule and whenever a key may have been exposed.
  1. Create a new API key with the same scopes.
  2. Deploy the new key to your integration.
  3. Verify the integration is using the new key.
  4. Revoke the old key in Settings > Developers > API keys.

​
Revoke an API key

Revoke a key when an integration is decommissioned, an owner leaves, or a key is suspected to be compromised. Revoked keys stop authenticating immediately.

​
Troubleshooting