Skip to content
Driive Help Center home
Driive Help Center home

API Keys

API keys let you connect external tools and custom applications to your Driive organization. Every API request is authenticated with a key, and each key is scoped to a single organization.

Why use API keys?

  • Integrate with other tools — Connect Driive to your CRM, field-service software, or custom internal tools
  • Build custom dashboards — Pull appointment, customer, and team data into your own reporting interface
  • Automate data exports — Schedule scripts that extract data from Driive on a regular basis
  • Authenticate MCP connections — The MCP Server uses an API key for authentication

Creating an API key

  1. Navigate to Setup > Developer > API Keys.
  2. Click Create API Key.
  3. Enter a descriptive Name for the key (e.g., "Zapier Integration", "Custom Dashboard", "CRM Sync").
  4. Click Create API Key.
  5. Copy the key immediately — Driive shows it once in the confirmation dialog: "Your API key has been created. Copy it now - you won't be able to see it again." The key is masked by default; use the eye button to reveal it and the copy button to copy it. Store it in a secure location (like a password manager or environment variable).

Important: If you lose your API key, you cannot retrieve it. You'll need to create a new one and update your integrations.

How API keys are stored

Driive takes API key security seriously:

  • Keys are hashed before being stored — Driive never stores your key in plain text
  • Only a key prefix is saved for identification (e.g., sk_live_a1b2...), so you can tell your keys apart in the management interface
  • The full key is shown once at creation and never again

Managing your API keys

The API Keys page shows all keys for your organization. For each key, you can see:

ColumnDescription
NameThe label you assigned when creating the key
KeyThe first few characters of the key for identification
CreatedWhen the key was generated
Last UsedWhen the most recent API request was made with this key ("Never" if it hasn't been used)

Revoking a key

If a key is compromised or no longer needed:

  1. Find the key in the API Keys list.
  2. Click the ⋯ menu at the end of its row and choose Revoke.
  3. Confirm in the Revoke API Key? dialog.

The key stops working immediately. Any integrations using it will begin receiving authentication errors.

Tip: Before revoking a key that's actively in use, create a replacement key first and update your integration. Then revoke the old one to avoid downtime.

Using your API key

Include your API key in the Authorization header of every API request:

Authorization: Bearer sk_live_your_api_key_here

Example request:

GET /v1/organizations/{orgId}/appointments
Authorization: Bearer sk_live_your_api_key_here
Content-Type: application/json

All API requests are scoped to the organization the key belongs to. You cannot access data from other organizations with the same key.

Every available endpoint is documented in the interactive API reference, generated straight from the API's OpenAPI spec.

Security best practices

Follow these guidelines to keep your API keys secure:

  • Never share keys in plain text — Don't send keys over email, Slack, or other messaging tools. Use a password manager or secrets management service.
  • Store keys as environment variables — Never hard-code keys in your application source code or check them into version control.
  • Use one key per integration — Give each tool its own key so you can revoke one without breaking the others, and tell them apart by the "Last Used" column.
  • Rotate keys regularly — Create a new key, update your integration, then revoke the old key. This limits the window of exposure if a key is leaked.
  • Monitor last-used timestamps — Check the "Last Used" column periodically. If a key hasn't been used in a long time, consider revoking it.
  • Revoke compromised keys immediately — If you suspect a key has been exposed, revoke it right away and create a replacement.

Next steps

Powered by Plain