API keys, scopes, and access boundaries

Step-by-step walkthrough

1. 01

   Open Developer API with a role allowed to manage integrations. Create a key for one named integration and select only the required scopes.

2. 02

   Copy the token when it is shown and store it in your server’s secret management. Do not expose the key in frontend code, screenshots, or application logs.

3. 03

   Use Authorization: Bearer with the key. Ticket write, reply, field, and assignment scopes have prerequisite read scopes; review the contract for each operation.

4. 04

   Test a permitted read and a denied operation before enabling writes. Current account permissions and ticket visibility still apply to key requests.

5. 05

   Revoke a key when the integration is retired or exposed. Create a replacement and update the receiver deliberately rather than leaving unused keys active.

A closer look at the interface

These are actual product captures from a fictional demo workspace. Navigation and available controls can differ by role, configuration, or release.

Developer API workspace

View full screenshot

Developer API workspace

The developer area explains scopes, request versions, assignments, and the downloadable contract.

1. 1Start with a narrowly scoped API key.
2. 2Use the deployment’s real API base URL, not the demo localhost URL.
3. 3Download the current contract before implementing write operations.

Important details