How to Create and Manage API Keys

API keys let you connect external tools, scripts, and AI agents directly to your TrustPager workspace. You create them at https://app.trustpager.com/settings/api. Each key gets its own set of permissions — from read-only to full admin — so you can give each integration exactly the access it needs, nothing more.

API access requires the Pro plan. If you see an upgrade prompt at https://app.trustpager.com/settings/api, head to https://app.trustpager.com/settings/billing first.

Create a new API key

1. Go to https://app.trustpager.com/settings/api.
2. Click Create API Key.
3. Give the key a descriptive name — something that identifies the tool it will be used with, e.g. Claude Desktop or Zapier.
4. Choose the permission level (see below).
5. Click Create Key.
6. Copy the key immediately. It starts with tp_live_ and will only be shown once. Store it somewhere secure — a password manager or secrets vault. If you lose it, you will need to delete the key and create a new one.

Permission levels

When creating or editing a key, you choose between two modes:

• Full Access (Admin) — the key can do everything your workspace admin can do: read, write, and delete all records, manage settings, and approve or reject AI agent actions.
• Custom Scopes — you set a permission level per resource using sliders. This is the right choice for integrations that only need to touch specific parts of your workspace.

Scope levels by resource type

Most resources follow this ladder:

Level	Scope value	What the key can do
No Access	—	Resource is completely hidden from this key
Read	resource:read	Read-only: list and fetch records
Write with Approval	resource:write-approval	Creates and updates are queued for a human to approve before they go through
Write Automatically	resource:write	Creates and updates apply immediately, no approval needed
Delete with Approval	resource:delete-approval	Deletions are queued for approval
Delete Automatically	resource:delete	Deletions apply immediately

Communication resources (email, SMS, calls) use a slightly different ladder: read → send-approval → send. AI features use use-approval → use.

The Admin Only group (company settings, billing, users, integrations) is highlighted in yellow as a reminder — restrict those to keys you fully trust.

Approval scopes and the Approvals tab

If a key has any -approval scopes (or Full Access), its actions that require approval land in the Approvals tab at https://app.trustpager.com/settings/api. From there, a workspace admin can review the proposed change, approve it to let it through, or reject it with a reason.

This is the recommended permission level for AI agents — they can take action autonomously, but anything write-level goes through a human checkpoint first.

You can optionally configure a rejection webhook URL on a key (edit the key after creation). When an approval is rejected, TrustPager will POST the rejection reason and original request body to that URL — handy for notifying an agent that its action did not go through.

Rate limits

Every key is provisioned with:

• 120 requests per minute (rate limit)
• 50,000 requests per day (daily limit)

These defaults cover the vast majority of integrations and automation workloads. If you consistently hit the daily limit, contact support via https://app.trustpager.com/service-requests.

Edit a key

Go to https://app.trustpager.com/settings/api, find the key, and click Edit. You can update the name, change the permission level or individual scopes, and add or remove a rejection webhook. Scope changes take effect immediately on the next API request.

Revoke a key

Click Revoke on the key. This disables it instantly — any request using a revoked key will be rejected with a 401. The key stays visible in the list so you have a record of it. You can re-activate it at any time by clicking Activate.

If you suspect a key has been compromised, revoke it immediately, then create a new one and update your integration.

Delete a key

Click Delete to permanently remove the key and all its usage history. This cannot be undone.

OAuth clients (for Claude.ai and MCP integrations)

The page also has an OAuth Clients section. OAuth clients are a different credential type designed for AI tools like Claude.ai that connect via the TrustPager MCP server. If you are connecting Claude.ai, create an OAuth client rather than a plain API key — the full setup walkthrough is at https://trustpager.com/help-center/connect-claude-to-trustpager.

For scripts, Zapier, Make, custom code, and most integrations, a regular API key is the right choice.

Troubleshooting

• 401 Unauthorized — the key is invalid, revoked, or you are sending it incorrectly. Keys must be sent as Authorization: Bearer tp_live_... in the request header.
• 403 Forbidden — the key does not have the required scope for the action you are attempting. Edit the key and increase the permission level for that resource.
• Rate limit errors (429) — you have exceeded 120 requests per minute. Add a small delay between requests or batch operations where possible.
• Approval actions are not going through — check the Approvals tab at https://app.trustpager.com/settings/api. A team admin needs to approve them before the action is executed.
• Cannot see the API settings page — API access requires the Pro plan. Upgrade at https://app.trustpager.com/settings/billing.