API Key Management (Business Plan)
Create and manage API keys for external integrations with granular scope control and rate limits
What You'll Learn
- Create API keys with specific scopes
- Understand available API scopes (clients, quotes, projects, tasks, time tracking, invoices, expenses, reports, webhooks)
- Set rate limits and expiration dates
- Monitor API usage and errors
- Toggle keys active/inactive
Business Plan Required
API key management is a Business plan feature. Free and Professional plan users see an upgrade screen when accessing API settings.
Access Requirements
Business Plan
API access requires the Business plan ($36/mo)
Up to 10 Keys
Business plan supports a maximum of 10 API keys
Owner or Permission
Requires owner role or api_management permission at read_only level
Free & Pro Plans
No API access — shows an upgrade screen
API Dashboard
The API settings page provides a comprehensive dashboard for monitoring and managing your API keys.
Usage Statistics
- Total requests
- Success rate
- Average response time
- Active key count
API Keys Table
- Key name & ID
- Status (active/inactive)
- Scopes & rate limit
- Last used date
Recent Errors
Last 10 error responses for troubleshooting failed API requests
Quick Start Guide
In-app guide to help you make your first API request
Creating an API Key
Create a new API key by providing a name, selecting scopes, and configuring rate limits.
Name your key
Give your key a descriptive name (required, up to 255 characters). Use something that identifies the integration, like "Zapier Integration" or "Mobile App".
Select scopes
Choose which API resources this key can access. At least one scope is required. Default scopes (clients:read, projects:read, invoices:read, expenses:read) are pre-selected for new keys.
Set rate limit
Choose a rate limit for this key: 500, 1,500, or 3,000 requests per period.
Set expiration (optional)
Optionally set an expiration date for the key. The date must be in the future. Keys without an expiration date remain active indefinitely.
Copy your secret
After creation, the full API key is displayed once. Copy it immediately — the secret is hashed before storage and cannot be retrieved later.
Key Format
bc_xxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxKeys follow the format bc_{16-char}.{32-char-secret}. The prefix identifies it as a WorkCentral API key.
Copy Your Secret Immediately
Your API key secret is shown only once when created. Copy it immediately and store it securely. If you lose it, you'll need to create a new key.
Available API Scopes
WorkCentral provides 22 granular scopes across 8 resource categories. Each scope controls access to specific API operations.
Clients
clients:readView clientsclients:writeCreate and update clientsclients:deleteDelete clientsQuotes
quotes:readView quotes and proposalsquotes:writeCreate and update quotesquotes:deleteDelete quotesProjects
projects:readView projectsprojects:writeCreate and update projectsprojects:deleteDelete projectsTasks
tasks:readView project taskstasks:writeCreate, update, and manage taskstasks:deleteDelete tasksTime Tracking
time_tracking:readView time entries and reportstime_tracking:writeCreate, update, approve time entriestime_tracking:deleteDelete time entriesInvoices
invoices:readView invoicesinvoices:writeCreate and update invoicesinvoices:deleteDelete invoicesinvoices:sendSend invoices via emailExpenses
expenses:readView expensesexpenses:writeCreate and update expensesexpenses:deleteDelete expensesOther
reports:readAccess reporting endpointswebhooks:manageManage webhook subscriptionsDefault Scopes
New API keys are pre-selected with these read-only scopes:
clients:readprojects:readinvoices:readexpenses:readPro Tip: Least Privilege
Start with read-only scopes and add write permissions only as needed. This follows the principle of least privilege and reduces risk if a key is compromised.
Managing Your Keys
After creating a key, you can edit its settings, toggle it on or off, or delete it entirely.
| Action | What It Does |
|---|---|
| Edit | Change name, scopes, rate limit, or expiration date |
| Toggle | Switch a key between active and inactive without deleting it |
| Delete | Permanently remove the key — any integration using it will stop working |
Editable Fields
| Field | Details |
|---|---|
| Name | Required, up to 255 characters |
| Scopes | At least 1 valid scope required |
| Rate Limit | 100 to 10,000 requests (customizable when editing) |
| Expiration | Optional, must be a future date |
| Active Status | Toggle on/off |
Toggle vs Delete
If you need to temporarily disable a key (for debugging or maintenance), use the toggle feature instead of deleting. Toggling preserves the key's configuration so you can re-enable it later.
You're All Set!
You now know how to create and manage API keys in WorkCentral. Start with read-only scopes, copy your secret immediately after creation, and monitor usage from the API dashboard.