Create an organization API key through the Compliance Platform or the User API. The secret is returned only when the key is created. Send the key as a bearer token with every Service API request.
The API key selects the organization. You do not send an organization ID in the Service API path or request body.
Use the Service API only from a trusted backend. Never put an organization API key in browser code, a mobile application, or a public repository.

​
Manage API keys

An authorized user manages keys through these User API methods: The Service API returns 401 Unauthorized when the bearer token is missing, invalid, or revoked.