---
title: "Generating an API key"
slug: "generating-an-api-key"
updated: 2026-08-10T06:00:06Z
published: 2026-08-10T06:00:06Z
canonical: "apidocs.document360.com/generating-an-api-key"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://apidocs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Generating an API key

Document360 uses API-key-based authentication to secure the v3 API. Every API request must include a valid API key in the `X-API-Key` header. The API key grants access based on the portal role, content role, and content access configured when it is created.

Note

A scoped API key is assigned a portal role, a content role, and a content-access scope — so the key can do exactly what a team member with those roles could do, and no more. The generated secret begins with `d360_sk_` and is shown only once.

If you already have a valid v3 API key, you can skip this article.

## Generating a new API key

To create a new API key in Document360:

1. Log in to the knowledge base portal.
2. Navigate to **Settings** > **Knowledge base portal** > **API keys**.
3. The **API keys** overview page appears with a list of previously generated keys (if any).

![API keys overview page in the knowledge base portal](https://cdn.document360.io/2b5c503e-f283-4987-b5a8-2b71b454ecec/Images/Documentation/v3-api-keys-page-v2.jpg)

Each row on this page also has **Edit** and **Delete** actions, so you can rename a key, adjust its roles and access, or remove it entirely.

1. Click **Create API key**.
2. Enter a **Name** that describes where the key will be used, for example `Production content sync`.
3. Select a **Portal role** — this controls the portal-level actions the key can perform.
4. Select a **Content role** and choose the content access it applies to — either the entire project, or specific workspaces, languages and categories.
5. Under **Set expiry**, choose **Never**, or select **Choose date** to bound the key's lifetime.
6. Click **Generate key**, then copy the key immediately.

![The Add API key dialog showing name, portal role, content role and access, and expiry](https://cdn.document360.io/2b5c503e-f283-4987-b5a8-2b71b454ecec/Images/Documentation/v3-add-api-key-modal-v2.jpg)

Important

The full API key is displayed only once, at creation time. Copy and store it securely right away. If it is lost, revoke the key and create a new one — the secret cannot be retrieved again.

Tip

Treat your API keys like passwords. Never expose them in public repositories, client-side code, or unsecured locations. Scope each key to the least privilege it needs, and set an expiry where possible.

## Using the API key

Send the API key in the `X-API-Key` header of every request:

```
X-API-Key: d360_sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

The following example lists the projects the key can access:

```
curl --request GET "https://apihub.document360.io/v3/projects" \
  --header "X-API-Key: d360_sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
```

All requests must be made over HTTPS. Requests sent over HTTP or without a valid API key will fail.

Note

The `Authorization: Bearer` header is reserved for OAuth 2.0 access tokens, such as those used by the interactive API reference. Use `X-API-Key` for API keys.

Note

A key can never be granted more access than the user who creates it currently holds. If you select a portal role, content role or content access wider than your own, the request is rejected.