Manage Wave API Access Keys

Wave API access keys are managed under Settings, then Access Keys. An access key grants persistent programmatic access, so treat it like a password.

Click or tap to enlarge

Important: Selecting Generate Key creates a live key immediately. It does not open a confirmation form first. Be ready to store and protect the new value before selecting it.

What the Access Keys Screen Shows

The screen lists:

• key name
• key value
• creation date
• last-used information
• enable or disable control
• row actions

The enabled or disabled state controls whether the integration can continue using that key. The Last used value can help determine whether an expected integration is reaching Wave.

Before Generating a Key

Confirm:

1. which integration will use it
2. which Wave persona the integration should access
3. where the secret will be stored
4. who is authorized to use or rotate it
5. how the integration will be tested without sending to customers

Also confirm that a new key is necessary. Reuse an existing key only when its owner, purpose, and storage are understood. Do not generate extra credentials merely for a screenshot or test.

Generate and Store the Key

1. Open Settings and select Access Keys.
2. Confirm the active persona.
3. Prepare the integration's secret manager or protected environment-variable system.
4. Select Generate Key only when you are ready to capture the new value.
5. Copy the complete value directly into the protected destination.
6. Record the owner, purpose, and creation date outside the key value itself.
7. Test the integration with the smallest safe, non-sending request supported by the official API documentation.

Never paste a real key into a support message or public page. When support needs to identify a key, use its name, creation date, and enabled state instead of the secret value.

Protect the Key

• Never place a real key in a screenshot, knowledge-base page, chat message, or public repository.
• Store it in the integration's secret manager or protected environment-variable system.
• If key renaming is available in your account, use a descriptive name. Otherwise, record the owner and purpose in the integration's credential inventory.
• Disable or replace a key when its integration is retired or its exposure is uncertain.
• Review last-used information when troubleshooting an integration.

Disable or Replace a Key

Disable a key when an integration should temporarily lose access or when exposure is suspected. Replace a key when the integration is moving to a new credential.

A safe replacement sequence is:

1. generate and store the replacement
2. update the authorized integration
3. verify the integration with the replacement
4. disable the old key
5. monitor for unexpected failures
6. remove the old key only after confirming it is no longer required

Changing key state can interrupt a live integration. Confirm the target key and integration owner before disabling or removing anything.

Troubleshoot an Integration

• Authentication fails: Confirm that the integration uses the complete key from the correct persona.
• The key is present but requests fail: Check whether the key is enabled and review Last used.
• Last used never changes: Confirm that the integration is sending requests to the intended Wave environment and credential.
• The key may be exposed: Stop sharing it, disable it, generate a replacement, and update the authorized integration.
• The endpoint behavior is unclear: Use the official API reference or contact Phound Support instead of guessing request fields.

The Access Keys screen manages credentials. It is not the same as a configuration bundle key. See Importing Configuration Bundles for reusable setup imports.

The official API reference should be used for endpoints, authentication headers, request fields, and rate limits. If an authoritative API reference is not available in your account materials, contact Phound Support before building the integration.