API keys grant developers complete access to the Kadence API, enabling them to retrieve user and booking data and to perform actions on behalf of Kadence users in a programmatic way.

Given the sensitivity of this information & associated actions, it's crucial to treat API keys with the same level of security as user credentials and passwords. We recommend you adhere to the following guidelines:

All keys should have appropriate names and descriptions to allow you to identify what it’s being for and who has access.
All API keys should be safeguarded by storing them securely and sharing them only with trusted parties who have a genuine need for access.
If you need to share an API key do so securely. For example through the use of a password manager or encrypted email.
Be careful not to accidentally expose API keys e.g. by checking them into publicly accessible code repositories.
Decide and implement a key rotation policy for your API keys.
Delete any API keys that are no longer required.
Each integration should have its own API key. In the event a key becomes compromised you can prevent access to the API from this one key without disabling access to all of your integrations.
Kadence API keys are used in the client credentials OAuth 2.0 grant type, and therefore should only be used in applications where the credentials can be kept secure. Kadence API keys should not be used in front-end or mobile applications where the keys cannot be kept secure.

For more information on our API please see our Developer Guide, or for help using our API for check-in see our Quick Start Guide.

How To Create an API Key

Overview