Skip to main content

​
Create an API key

Organization owners and admins can create keys in the Soundlink app — no support ticket required.

Open API keys in Settings

Sign in at Soundlink, open your profile menu → Settings, then Developer → API keys. The app uses your current organization automatically — no org ID in the URL.
1

Open the API keys page

From your profile menu, go to Settings → Developer → API keys. Soundlink scopes this page to your active organization — you never paste an org ID into the URL. You’ll see every key for the org — active, expired, and revoked — with scopes, expiration, and last used.
Soundlink Settings Developer API keys table with name, scopes, expiration, status, and Create key button

API keys list in Settings → Developer

2

Create a key

Click Create key. Give the key a name (required), choose an expiration, and select one or more scopes (at least one required).
Create API key dialog with name field, expiration dropdown, and scope checkboxes

Create key — name, expiration, and scopes

Start with 30 days and both read scopes if you’re exploring the API. Rotate or revoke the key when you’re done testing.
3

Copy and store the key

After you click Create key, Soundlink shows the full key exactly once. Copy it immediately and store it in your secrets manager or password vault.
You cannot retrieve the full key later — only revoke it and create a new one. The keys list never shows the secret, only a masked placeholder.
Save your API key dialog with masked key, reveal and copy buttons, and warning that the key is shown only once

One-time key reveal — copy before closing

Members (non-admin roles) see API keys in Settings but cannot open the page — ask an owner or admin to create a key for your integration.

​
API key format

Pass the full string in the Authorization header as a Bearer token (recommended):
The x-api-key header is deprecated and retiring 2026-08-17. It still works today, but migrate to Authorization: Bearer above before then:
Send exactly one of the two — sending both, or an unrecognized Authorization value, returns 401 with code mixed_credentials. Do not send Firebase Bearer tokens or legacy product headers on this host.

​
Scopes (v1)

Scopes limit which endpoints a key can call. Select them when you create the key; they cannot be changed without minting a new key. Typical read-only integrations enable both campaigns:read and metrics:read. Add campaigns:write only when the integration should spend wallet credit or manage delivery.
GET /v1/ping accepts any valid v1 key regardless of which read scopes you selected — useful for smoke tests after creation.

​
Expiration

Choose a lifetime at creation:
Prefer a fixed preset over Never for anything you can rotate. A key that never expires only goes away when someone remembers to revoke it.
After expiresAt, requests fail with 401 and api_key_expired. Keys created with Never have no expiresAt and only stop working when revoked. Create a replacement key before a fixed-lifetime key lapses, update your integration, then revoke the old key.

​
Organization isolation

Your organization is determined only from the API key. The API ignores x-organization-id and similar spoofed headers.

​
Key lifecycle

  • Active — key is within its expiration window and not revoked.
  • Revoked — you deleted the key in Settings; API returns api_key_revoked.
  • Expired — past expiresAt; API returns api_key_expired.
Revoked keys stay visible in the list with status and date so you can audit past integrations.

​
Ping vs data endpoints

​
Next

Verify your new key in Quickstart with GET /v1/ping, then list campaigns.