How to choose API key permissions

Where you choose them

Open Admin, then Settings, then Integrations, and look at the key form under Customer API keys. Workflow preset is near the top, and Exact permissions below it is the checkbox list of what the key will grant. While a preset other than Custom is selected, those checkboxes are fixed, and the form says Preset permissions are fixed. Choose Custom to change them.

Creating and rotating keys requires an active Pro plan, and you need to be an owner or admin of the Locker. If you have not made a key yet, Connect another tool to your Locker covers reaching this form.

Start with a preset

Each preset is a set of permissions for a common connection. Pick the one that matches the work, then read what it grants before you create the key.

• CRM sync: Members, contact data, enrollments, and completions. For a customer record system that tracks who is in the community and what they have finished. It does not include private notes, tags, follow-up dates, or saved views from People.
• Calendar sync: Published community events only. For sending your published events into a shared calendar.
• Invitation workflow: Member lookup and expiring invitation management. For a signup form or automation that should invite people into the community.
• Content drafts: Read and write drafts; publishing is not included. For a tool that prepares posts your team then reviews.
• Custom: Choose each permission explicitly.

What each permission covers

None of these permissions includes private notes, tags, follow-up dates, or saved views from People. Those stay in Admin, then People. See Find members and follow up in People.

• Courses: Read the course catalog. The tool can see which courses exist and how they are described.
• Enrollments: Read course enrollment state, without contact fields. The tool learns who is enrolled by identifier only, with no email address.
• Completions: Read course completion state, without contact fields. Same shape as enrollments, for finished work.
• Members: Read member identity and community status. The tool can see who belongs to the community and each member's status. It does not include private notes, tags, follow-up dates, or saved views from People.
• Member contact data: Share member email and other allowed contact fields. It adds those fields to records another permission already allows and opens nothing on its own.
• Calendar events: Read published community events. Published events only, which is why a calendar connection does not need anything else.
• Invitations: Create, inspect, and revoke expiring invitations. The tool can send an invitation, but a person still accepts it in Lockers. See Invite members from another tool.
• Read post drafts: Read integration-created drafts. Limited to drafts the integration itself made.
• Write post drafts: Create and update attributed drafts. The drafts stay attributed to the connection that wrote them.
• Publish posts: Publish a draft as a separate action. Grant it only when you want the tool to publish drafts to members with no person reviewing them first.

Member contact data adds email and contact fields to allowed records

Member contact data never opens a resource by itself. It adds name and email to resources another permission already allows, and without it those fields are left out. A key with Members and no Member contact data can tell your tool who is in the community and what their status is, with no email address attached.

An automation that counts members or checks status can work with Members alone, so the email addresses stay in Lockers. Add Member contact data when the tool has to reach the person directly.

Course restrictions narrow three things

The course restrictions field takes a list of courses, with the placeholder course-one, course-two, and the helper text under it reads: Leave blank for all courses. Restrictions apply only to course, enrollment, and completion reads/events; other scopes remain independent.

Listing two courses limits course, enrollment, and completion reads, and the matching webhook events, to those two. It does not narrow Members, Calendar events, Invitations, or any of the post permissions. If a tool should only ever touch one course, the restriction handles the course side and the checkboxes handle everything else.

When to choose Custom

Choose Custom when no single preset fits the connection. That happens when a tool needs pieces of two presets, such as calendar events plus member status, or when a preset grants more than you want the tool to have, such as contact data for a system that only counts enrollments. It also happens with publishing, which no preset includes because Publish posts is granted on purpose.

Under Custom, select only the permissions the work needs. The key does not include anything you leave unchecked, so a mistake in the connected tool cannot reach it.

Confirm what the key actually got

After Create key, select Test the connection under Connection check. It returns the connection's name, environment, permissions, restrictions, expiry, and quota windows, which is the record of what that key can do. Read it before you hand the key to anyone.

Every request also rechecks the admin who created the key, the community's status and plan, the key's expiry, and its quotas, so a key with the right permissions can still stop working for another reason. Rotate or revoke an API key covers those.

What webhook endpoints inherit

When you bind a webhook endpoint to a named connection, the endpoint's permissions and courses cannot exceed that connection's grants, and the form says so. Invitation and post events only reach an endpoint that is bound to a named connection. So an endpoint tied to a key can deliver only what that key's permissions allow. Receive webhooks from your Locker has the endpoint side.

Changing access later

Rotating a key keeps the connection's identity, so drafts, invitations, and webhook bindings made through it stay attributed to it. Permissions are fixed when the key is created, and rotation keeps them as they were. To change what a tool can reach, create a new key with the right permissions, move the tool onto it, and revoke the old one.