Integrations and automation
Create and revoke an API key
Last updated
An API key lets a system you run enroll learners into your courses without anyone opening the platform. A signed contract, a completed checkout, a new starter in your HR system, each can put someone on a course by itself.
Keys belong to one organization and act only on that organization's data.
What a key can do
One thing: create enrollments.
That is the whole of it, and it is deliberate. A key is a password that lives in somebody else's system, so it can do the one job it is issued for and nothing more. It cannot read your learners, change a course, cancel an enrollment, or see anything about your billing.
If a key leaks, the worst somebody can do with it is enroll people into your own courses.
Creating one
Open your organization and go to the API Keys tab.
Choose to add a key and give it a name.
Copy the key from the dialog that appears.
Name it after the system that will use it — "Zapier", "HubSpot", "our website" — not after yourself. When you come back in a year to work out whether a key is still needed, the name is all you will have.
The key is shown once and cannot be shown again
We store only a fingerprint of it, never the key itself, so there is no way for anyone — including us — to look it up later.
Copy it into wherever it is going before you close the dialog. If you lose it, issue a new key and revoke the old one; there is no recovery.
Only admins can issue keys
Editors, instructors and viewers cannot create or revoke keys, even though some of them can enroll learners through the platform.
The reason is that a key acts with whatever it was granted, wherever it ends up. Letting somebody issue one would let them hand out access that outlives their own — and keeps working after they leave.
Using it
Whatever you are connecting sends the key as a bearer token:
Authorization: Bearer elk_...Most tools ask for it as an "API key" or "bearer token" and handle the rest. For anything custom, the full reference is at the API documentation.
What you can see afterwards
The keys list shows each key's identifier, what it is allowed to do, whether it is still active, and when it was last used — but never the key itself.
Last used is the useful column. A key that has never been used usually means an integration that was never finished. A key that stopped being used months ago is one you can safely revoke.
Revoking a key
Revoking stops a key working immediately, and cannot be undone.
The record stays in the list rather than disappearing, so the history of which keys existed and when each was last used survives. Anything still using that key starts failing at once — so revoke a key that is in service only when you have already replaced it, or when you would rather it stopped than carried on.
Revoke a key when the integration using it is retired, when somebody who had access to it leaves, or the moment you think it might have been exposed. Keys are free to issue, and there is no reason to keep an old one alive.