Skooh.io Logo
Documentation
Docs/API Keys

API Keys

What are API Keys?

API keys are authentication tokens that allow you to programmatically access the Skooh API. They're used to authenticate requests when using the API directly, or when configuring the desktop app or Docker proxy.

Each API key is unique to your account and should be kept secret. API keys have the same permissions as your user account, so anyone with access to your API key can manage your webhooks and endpoints.

Generating API Keys

To generate a new API key:

  1. Go to Settings in your Skooh dashboard
  2. Scroll down to the API Keys section
  3. Click Create API Key
  4. Enter a descriptive name (e.g., "Desktop App - MacBook" or "Production Server")
  5. Optionally set an expiration date
  6. Click Create

⚠️ Important: Copy your API key immediately

API keys are only shown once when created. If you lose your API key, you'll need to create a new one. Make sure to copy it to a secure location before closing the dialog.

A default API key is automatically created when you sign up. You can view and copy it from Settings → API Keys anytime, but you cannot see the full key value again after creation—only the first few characters for identification.

Using API Keys

API keys are used in several ways:

1. API Requests

Include your API key in the Authorization header:

curl -X GET 'https://api.skooh.io/hook_admin/hooks' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json'

2. Desktop App

Enter your API key in the desktop app's configuration. The app uses this key to authenticate with the Skooh API and establish the WebSocket connection for receiving webhooks.

3. Docker Proxy

Use the --api-key argument or API_KEY environment variable:

docker run -d \
  --name skooh-proxy \
  -e API_URL=https://api.skooh.io \
  skooh/proxy \
    --token your_hook_token \
    --api-key your_api_key \
    --internal-webhook-url http://host.docker.internal:3000/webhook

Best Practices

Use separate keys for different environments

Create different API keys for development, staging, and production. This makes it easier to rotate keys and revoke access if needed.

Use descriptive names

Name your API keys clearly (e.g., "Desktop App - MacBook Pro" or "Production Server - us-east-1"). This helps you identify which key is being used where.

Rotate keys regularly

Periodically rotate your API keys, especially if you suspect one may have been compromised. Create a new key, update your applications, then delete the old key.

Set expiration dates

When creating API keys, consider setting an expiration date. This ensures keys are automatically revoked after a certain period, reducing the risk of long-lived compromised keys.

Never commit keys to version control

Always store API keys in environment variables or secure secret management systems. Never commit them to Git repositories or share them in plain text.

Skooh | API Keys