Skip to main content

API Keys

For:Administrator
View of the « cles api » page

An API key is a secret identifier that allows an external tool (Make, n8n, Zapier, a custom script, a CRM, etc.) to access or manipulate the authorized data of your Unisoft organization. This page explains how to create, modify, and revoke these keys securely.

Open the API Keys tab​

  1. 1

    Go to the Developers page

    Type the URL /app/developpeurs/tabs in the address bar, or open your saved bookmark.

  2. 2

    API Keys tab

    The tab is selected by default when the page opens.

Understanding the table​

The central table lists your organization’s existing API keys. For each one, you see:

ColumnContent
NameThe label you chose when creating it (e.g., Make - sync Mailchimp)
PrefixThe first 12 characters of the key followed by … (for example, ke_live_abcd…), displayed clearly so you can identify it in the list. The full key is never shown again after creation.
PermissionsThe scopes granted — read and actions the key can perform
Last UsedThe relative date of the last API call made with this key, or never
StatusActive (green), Revoked (red), or Inactive (gray)
ActionsModify name or permissions, Revoke, and Delete

Create a new key​

  1. 1

    Click on “New key”

    The button is located in the top right corner of the tab. A modal window will open.

  2. 2

    Give an evocative name

    Enter a descriptive name such as Make production, Zapier Mailchimp, or Accounting export script. This will help you keep track of them later when you have multiple keys.

  3. 3

    Choose permissions

    Select the scopes that the integration requires. The shortcuts Read-only, All, Event Journeys only, and None speed up the selection; then review each permission individually.

  4. 4

    Click “Create key”

    A new modal window appears immediately showing the raw key.

  5. 5

    Copy the key without waiting

    Click “Copy the key” or use the copy icon. You will never see this key again once the modal is closed — paste it immediately into your tool or password manager.

  6. 6

    Confirm

    Click “I’ve copied the key” to close the modal.

Available permissions​

The selector loads the current list from the API and groups it by category: contacts, payments, subscriptions, Pledges, forms and registrations, Funds, events, communications, pages, menu, site, Event Journeys, Mobile App, statistics, and webhooks.

For each domain, Reading allows viewing. Writing, Management, Approve/Reject, or Send trigger actual modifications or actions. For example, approving an enrollment may send an email, creating a payment may generate a link or import historical receipts, and sending a campaign may incur SMS costs.

Modifying an existing key​

Open the Modify action to change its name or permissions. The secret remains unchanged: the connected tool keeps the same key, but its new rights take effect immediately. Therefore, removing a scope can interrupt part of the integration without completely disconnecting it.

Using the key in an external tool​

Once you have the key, here’s how to use it:

In a raw HTTP call​

All requests to the Unisoft API must include the key in the HTTP Authorization header in Bearer format:

GET /integrations/v1/contacts HTTP/1.1
Host: api.unisoft.world
Authorization: Bearer ke_live_xxxxxxxxxxxxxxxxxxxxx

In Make / Integromat​

  1. Create an HTTP or Webhook connection.
  2. Authentication type: Bearer Token (or Header depending on the module).
  3. Value: your key ke_live_....

In n8n​

  1. Add an HTTP Request node.
  2. Authentication: Header Auth.
  3. Name: Authorization, Value: Bearer ke_live_....

In Zapier​

  1. Select the action Webhook by Zapier → Custom Request.
  2. Headers: add Authorization: Bearer ke_live_....

For the complete list of endpoints (URLs, parameters, response formats), consult the Swagger documentation using the “API Documentation” button at the top right of the Developers page.

Revoke a key​

Revoking immediately disables the key. Any integration that uses it will stop at the next request.

  1. 1

    Find the key in the table

    Identify the key by its name or prefix.

  2. 2

    Click “Revoke”

    The button is located in the Actions column. A confirmation request appears.

  3. 3

    Confirm

    Confirm the revocation. The key’s status changes to Revoked (red tag). It can no longer be reactivated.

Delete a key​

Deleting a key removes it from the table. It is no longer listed, but the functional result is the same as revocation: the key no longer works.

  1. 1

    Click the Delete icon

    Red trash icon in the Actions column.

  2. 2

    Confirm

    The key disappears from the list.

Prefer revocation over deletion if you want to keep a record of a key for auditing purposes. Reserve deletion for cleaning up old keys that have no historical significance.

Practical example: configuring Make to sync contacts with Mailchimp​

  1. 1

    Create a dedicated key

    Name: Make - sync Mailchimp. Permission: only contacts:read (nothing else).

  2. 2

    Copy the key to the clipboard

    Save it in your password manager or paste it directly into Make in the next step.

  3. 3

    Configure the Make scenario

    Module: HTTP → Make a request. URL: https://api.unisoft.world/integrations/v1/contacts. Method: GET. Header: Authorization: Bearer ke_live_....

  4. 4

    Testing the scenario

    Make must receive the list of contacts. If so, proceed with the next step (Mailchimp → Add/Update Subscriber).

  5. 5

    Schedule execution

    Set the desired frequency (every hour, every day, etc.). The script will run automatically.

Best security practices​

RuleWhy
A key per integrationIf a key is compromised, you can revoke it without breaking other tools
Minimum permissionsCheck only the scopes that are strictly necessary
Secure storagePassword manager (1Password, Bitwarden, KeePass…) or your tool’s environment variables — never in plain text in a file
Regular monitoringCheck the Last used column every quarter. An inactive key is an unnecessary risk
Periodic rotationFor critical integrations, create a new key every 6-12 months and revoke the old one

Traps to avoid​

TrapConsequenceSolution
Closing the modal without copying the keyKey lost, integration impossibleCreate a new key and delete the previous one
Storing the key in an email or Slack messagePotential compromiseAlways use a password manager
Checking all permissions out of habitMaximum attack surfaceUncheck those not required for integration
Reusing the same key for multiple toolsDifficulty tracking who is accessing whatOne key = one tool = descriptive name

To remember​

  • An API key allows an external tool to access or modify only the authorized domains.
  • The raw key is displayed only once at creation — copy it immediately.
  • The “Revoke” button stops any integration using the key instantly.
  • A key per use and minimum permissions are the two golden rules.

Limiting a key to campaigns​

A key can be restricted to an explicit selection of donation campaigns. In this mode, it cannot create campaigns, and its financial access remains limited to the selected campaigns. Select the useful permissions in addition to this scope: a campaign ID does not grant any additional rights.

Campaign and hosted payment operations are described in the API documentation for your environment. Payment imports are handled through the authorized REST API; do not assume it is available as an action of an AI assistant.

Going further​