Reference — lookup information.
Overview
Manage Apps is a centralized interface for admins to view, create, audit, and manage all API keys and integrations in their Affinity instance. This feature provides visibility into active integrations, enables security compliance, and supports safe API key lifecycle management. Who can access: Enterprise Admins (EAs) and Admins with “Manage all API keys” permission Where to access: Settings > Manage Apps (in the Developer Tools section of Settings)Key Concepts and How It Works
API Keys
What they are: API keys are authentication credentials that allow external applications to programmatically access your Affinity data via the Affinity API (v1 or v2). Types of API keys: Personal API Keys:- Created by individual users for their own integrations
- Bound to the user’s permissions and data access
- Subject to org-level API rate limits
- Appear in Manage Apps table with user’s name
- Can be managed by the user who created them or admins
- Created by Affinity’s Professional Services team for customer integrations
- NOT bound to customer’s API rate limits
- Have administrative rights (subject to Enterprise Permissions visibility rules)
- Appear in Manage Apps as “Affinity Professional Services Key”
- Can only be created by Professional Services team members
- Can be revoked by customer admins
Manage Apps Page
What it shows:- All active API keys in your instance (personal + Affinity Help)
- Revoked/historical API keys
- API usage metrics and rate limits
- Key details: Name, Description, Created date, Last used, Owner
- Audit: See all keys across your entire organization
- Create: Generate new API keys with names and descriptions
- Edit: Update key names and descriptions for documentation
- Revoke: Disable keys that are no longer needed or are security risks
- Monitor: Track API usage against monthly limits
- View API usage and monthly limits
- See all API keys in instance (active and revoked)
- Create API keys with names and descriptions
- Edit key details
- Revoke keys (your own or others’ if you have permission)
- Sort and filter keys table
- Create multiple API keys per user
- Per-minute rate limits apply per user, not per key
Permissions Model
Who Can Do What
Permission configuration:
- Enterprise Admins: Configure permissions in Settings > Users & Permissions > Roles
- Non-Enterprise orgs: All admins have full Manage Apps access by default
- “Generate an API key” permission: Set on each role in Settings > Users & Permissions > Roles (Admins, EAs, and Standard users can have this)
What is an Enterprise Admin (EA)?
Enterprise Admins are a user role available on Affinity’s Enterprise tier with elevated permissions across the CRM, including:- Full admin capabilities (user management, billing, settings)
- Ability to configure custom roles and permissions
- Access to advanced security and compliance features
- Can grant/revoke “Manage all API keys” permission to other users
CRUD - Create, Read, Update, Delete
Create API Key
Steps
- Navigate to Settings > Manage Apps
- Click + New App (if a menu opens, choose API Key)
- Add Name (required) - describes purpose of integration
- Add Description (optional) - additional context
- Choose a Default API Version (new keys default to the latest version)
- Optionally, add an IP Allowlist - one IP address or range per line, up to 100 (this field may be unavailable if your admin restricts who can set IP allowlists)
- Click Add App
- Copy API key secret (shown only once)
- Store secret securely in your integration
View API Keys
View all keys (Admins):- Navigate to Settings > Manage Apps
- See table showing all keys in instance:
- Personal keys from all users
- Affinity Help keys (Professional Services)
- Revoked/historical keys
- Sort by: Name, Owner, Created date, Last used
- Filter to active or revoked keys
- See only keys they created
- Cannot see other users’ keys
- Can see API usage metrics for org
- Name
- Description
- Owner (user who created it)
- Created date
- Last used date
- Status (Active or Revoked)
Update API Key
Edit own key:- Click on key in Manage Apps table
- Key detail panel opens
- Edit Name or Description
- Click “Save”
- Same process, but can edit any user’s key
- Useful for adding documentation to undocumented keys Note: Cannot edit the key secret itself - must revoke and create new key to rotate secrets
Delete (Revoke) API Key
Revoke own key:- Navigate to Manage Apps
- Click on key to open detail panel
- Click “Revoke” button
- Confirm revocation
- Key immediately stops working - any integration using it will fail
- Same process
- Used for security incidents or deactivated users
- Useful for removing Affinity Help keys after Professional Services engagement ends
- Remains visible in Manage Apps table (for audit trail)
- Marked as “Revoked” status
- Can be filtered out using table controls
- Cannot be un-revoked (must create new key) Permissions: Own keys (anyone), others’ keys (Manage all API keys permission required)
API Usage Metrics
What you can see:- Monthly API limit: Total requests allowed per month for your org
- Current usage: Requests used so far this month
- Usage percentage: Visual indicator of consumption
- Reset date: When monthly counter resets Where to find: Top of Manage Apps page
- Tied to organization, not individual keys
- All API keys in org share the same monthly limit
- Limit determined by your Affinity subscription tier
- Requests made through Affinity MCP and OAuth apps count toward the same monthly limit, and are included in the usage shown on the Manage Apps page (as one combined total)
- Exceeding limit results in API request failures until reset
Frequently Asked Questions
General
Do customers need to change how they authenticate with the API? No. Existing API keys continue to work exactly as before. The Manage Apps interface is for visibility and management only. What happened to the old API page in Settings? The old API page has been removed. All API key creation and management now happens in Manage Apps (Settings > Manage Apps). Technical Contacts configuration has moved to its own dedicated page. Can I see API keys from before Manage Apps launched? Yes. All existing keys are visible in Manage Apps. Pre-existing keys have auto-generated names: “[First Name] [Last Name]‘s API Key”API Key Creation & Management
How many API keys can I create? You can create multiple API keys. Creating a new key doesn’t revoke your existing keys. We recommend a separate key for each integration, so you can revoke one without breaking the others. Can I create API keys for other users? No. Users must create their own API keys. Exception: Professional Services team can create Affinity Help keys for customer integrations. What happens if I deactivate a user who has an active API key? Their API key is automatically revoked when the user is deactivated. This prevents unauthorized access from integrations tied to former employees. The revoked key remains visible in Manage Apps for audit purposes. Can I rotate API keys (change the secret)? You can’t change the secret of an existing key, but you can rotate without downtime: create a new API key, update your integration to use it, confirm it works, then revoke the old key.Security & Auditing
Can I see which API endpoints a key is calling? No. You can see a key’s last used date, but not which endpoints it calls. Can Affinity view or manage API keys in my instance? Affinity Support team cannot create, view, or manage your API keys. Only Professional Services team can create Affinity Help keys for customer integrations (with your permission). You can revoke Affinity Help keys at any time. How do I know if an API key is still being used? Check the “Last Used” date in the Manage Apps table. If a key hasn’t been used in 90+ days, consider revoking it. Contact the key owner before revoking to verify it’s not in use. What should I do if I suspect unauthorized API access?- Immediately revoke the suspicious API key in Manage Apps
- Review all keys in your instance for unfamiliar integrations
- Contact Affinity support if you suspect a security breach
- Create new API keys for legitimate integrations
- Update your integration credentials promptly
Permissions
Who can access the Manage Apps page?- Enterprise orgs: Enterprise Admins and users with “Manage all API keys” permission
- Non-Enterprise orgs: All Admins
- Standard users: Can access if they have “Generate an API key” permission (but only see their own keys)
- Enterprise orgs: Settings > Users & Permissions > Roles > Configure “Manage all API keys” permission
- Non-Enterprise orgs: Promote user to Admin role
Troubleshooting
Problem: “I don’t see the Manage Apps menu option” Solutions:- Verify you’re an Admin or have “Manage all API keys” permission
- If you have “Generate an API key” permission, you should still see Manage Apps (with limited view)
- Contact your Enterprise Admin to grant permissions
- Verify your org has access to Manage Apps feature
- Check if the deactivated user created the API key (keys are user-bound)
- Revoked keys appear in Manage Apps - verify status
- Create new API key and update integration credentials
- Consider: Have integrations use service account or admin user keys to avoid this
- Check the key’s Name and Description in Manage Apps
- Contact the user who created the key (shown as Owner)
- Review your integration documentation or development team
- Add description to undocumented keys for future reference
- Creating a new key doesn’t revoke your existing keys, so a new key alone shouldn’t break an older integration
- Check whether the old key was revoked (its status shows Revoked in Manage Apps), or whether its owner was deactivated
- If the old key was revoked, update the integration with an active key
- Test the integration after any key change
Security Best Practices
Key Creation:- Use descriptive names (e.g., “Salesforce Integration”, “Data Warehouse Sync”)
- Add detailed descriptions (purpose, owner, contact info)
- Copy secret only once when shown (cannot be retrieved later)
- Store secrets securely (password manager, secrets management system)
- Never commit API keys to version control or share in emails
- Audit keys quarterly for unused or orphaned integrations
- Revoke keys for deactivated users immediately
- Document all integrations using API keys
- Review “Last Used” dates to identify stale keys
- Maintain inventory of which systems use which keys
- Limit “Manage all API keys” permission to security/ops team only
- Grant “Generate an API key” permission only to users who need API access
- Review permissions quarterly
- Use principle of least privilege
- If key compromised: Revoke immediately, create new key, update integration
- Monitor API usage for unusual patterns
- Keep audit trail of all key creation/revocation events
- Contact Affinity support for suspected security breaches