API Keys

An API key lets your own systems connect to NeonNow without a person signing in, for example a server that starts Agentic sessions or keeps CX operational parameters in sync. Each key belongs to the organisation and can only do what its permissions allow.

API keys are managed by Org Admins under Organisation Settings > Security > API Keys in the NeonNow Admin app. The list shows each key's name, client ID, access, expiry and who created it, and can be searched by name or client ID and filtered by product, full access or expired keys.

For developers

This page covers managing keys in the Admin app. To exchange a key for an access token and call the API, see Authentication in the developer documentation.

Creating a Key

1. Open Organisation Settings > Security > API Keys.
2. Select Create API Key.
3. Under Details, enter a Name that tells the key apart from others (for example, Agentic SDK production) and, optionally, a Description of what the key is for.
4. Choose when the key Expires: 7 days, 30 days, 90 days, 1 year, a Custom date, or No expiry.
5. Under Permissions, choose what the key can do. See Choosing Permissions.
6. Select Create API Key.

Keys that never expire

A key with No expiry keeps working until it's deleted. Only use it where rotating the key isn't practical, and delete it as soon as it's no longer needed.

Saving the Secret

When the key is created, the Your New API Key window shows its Client ID and Client secret. Your app needs both to connect.

1. Copy the client ID and the client secret, and store them somewhere safe, such as your organisation's secret manager.
2. Tick I've saved the secret somewhere safe, then close the window.

The secret is only shown once

The client secret can't be viewed again after this window is closed. If it's lost, create a new key and delete the old one.

Choosing Permissions

Permissions are grouped by product. Each product lists the resources a key can work with, and the actions allowed on each one.

Product	Resource	Actions
Agentic	Agent config: read your published agent settings.	Read
Agentic	Sessions: start sessions and record what happens in them.	Read, Create, Update
CX	Operational parameters: values your contact flows read while they run.	Create, Read, Update, Delete
CX	Custom schedules: opening hours and closures for your contact flows.	Create, Read, Update, Delete
CX	SCIM: user provisioning settings for your contact centres.	Create, Read, Update, Delete

There are three ways to grant access, from narrowest to broadest:

• Individual actions. Tick only the actions the key needs, for example Read on Custom schedules. The key gets exactly those actions and nothing more, even if more actions are added to that resource later.
• All on a resource. The key gets every action on that resource, including any added later.
• Everything in a product. The key gets everything in that product, including anything added to it later.

Full access gives the key everything in every product, now and later. It's best kept for testing.

Give each integration its own key

Grant only what an integration needs, and use a separate key for each one. That way each key can be changed or deleted without affecting the others.

Viewing a Key

Select a key in the list to see its Details (name, description, expiry, when it was created and last changed), its Credentials and its Permissions. The client ID is always shown; the client secret is hidden.

Editing a Key

1. Open the key and select Edit.
2. Change its name, description, expiry or permissions.
3. Select Save Changes.

Saving signs apps out

Saving any change signs out every app using the key. Apps built with the NeonNow SDKs sign back in on their own; other integrations need to request a new access token. The client ID and secret don't change.

An expired key can be given a new expiry date to bring it back into use.

Deleting a Key

Delete a key when it's no longer needed, or straight away if its secret may have been exposed.

1. Open the key.
2. Under Danger Zone, select Delete Key.
3. Enter delete key to confirm, then select Delete.

Every app and integration using the key loses access immediately. This can't be undone.

Who Can Manage API Keys

Only Org Admins can view, create, edit or delete API keys. See Roles and Permissions for the full breakdown.