Generating an API key

An API key is a credential that lets a program act as you. It carries exactly the permissions of your account: the trials you can see, the sites you are restricted to, whether you can export data or read fields flagged as PII. If you need an integration to have narrower access than you do, create a dedicated user for it with only the trial permissions it needs, and generate the key from that account.

Creating a key

  1. Open the account menu in the top-right corner of the web app and choose Account settings, then the Account tab.
  2. Under API keys, find Generate a new API key.
  3. Enter a name for your key. Use the name of the system that will hold it — Data warehouse sync, REDCap bridge — so you can tell keys apart later.
  4. Enter the number of days the key should be valid for, counted from now. Leave it blank for a key that never expires. Keys that expire are the safer choice: a key that has to be replaced every 90 or 365 days is one that cannot be forgotten about.
  5. Click Create key.

The key is shown once, in a dialog, with a copy button. Store it in your secrets manager before closing the message — Trialflare does not keep a copy you can read back, and the list of existing keys shows only names and dates.

Managing keys

Existing keys lists every active key on your account with its name, when it was created and when it expires. Delete a key from there when the integration that used it is retired or the key may have been exposed. Deletion is immediate: the next request made with that key is refused.

Every key stays tied to your account. If your account is disabled by a team manager, every key you created stops working at the same moment. Deleting your account deletes its keys.

Keys in the audit trail

Actions taken with an API key are recorded in the trial and team event logs exactly as if you had taken them in the web app, and the log entry notes which key was used. Anyone reading a trial's Settings → Logs tab will see the key's name against the event, which is one more reason to name keys after the system that holds them.

Keys and two-factor authentication

Two-factor authentication protects sign-in to the web app. It does not apply to API keys — a key is a bearer credential, and whoever holds it can make requests. Treat it as you would a password: never commit it to source control, never put it in a URL, and rotate it if you have any doubt about where it has been.

Keys are separate from the Connected applications listed below them in the same settings tab. Those are AI assistants connected through the MCP connector, which sign in through your browser rather than with a key you hold.