Choose API permissions

Open Admin, then Settings, then Integrations, and look at the key form under Customer API keys. Workflow preset sits near the top, and Exact permissions below it is the checkbox list of what the key will carry. While a preset other than Custom is selected, those checkboxes are fixed, and the form says Preset permissions are fixed. Choose Custom to change them.

Creating and rotating keys requires an active Pro plan, and you need to be an owner or admin of the Locker. If you have not made a key yet, Connect another tool to your Locker covers reaching this form.

Each preset is a set of permissions for a common connection. Pick the one that matches the work, then read what it grants before you create the key.

None of these permissions includes private notes, tags, follow-up dates, or saved views from People. Those stay in Admin, then People. See Find members and follow up in People.

Member contact data never opens a resource by itself. It adds name and email to resources another permission already allows, and without it those fields are left out. A key with Members and no Member contact data can tell your tool who is in the community and what their status is, with no email address attached.

That split is worth using. An automation that counts members or checks status can work with Members alone, and the email addresses never leave Lockers. Add contact data when the tool has to reach the person directly, and not before.

The course restrictions field takes a list of courses, with the placeholder course-one, course-two, and the helper text under it reads: Leave blank for all courses. Restrictions apply only to course, enrollment, and completion reads and events; other scopes remain independent.

Take that literally. Listing two courses limits course, enrollment, and completion reads, and the matching webhook events, to those two. It does not narrow Members, Calendar events, Invitations, or any of the post permissions. If a tool should only ever touch one course, the restriction handles the course side and the checkboxes handle everything else.

Choose Custom when the connection does not sit inside one preset. That happens when a tool needs pieces of two presets, such as calendar events plus member status, or when a preset grants more than you want the tool holding, such as contact data for a system that only counts enrollments. It also happens with publishing, which no preset includes because Publish posts is granted on purpose.

Under Custom, select only the permissions the work needs. Whatever you leave unchecked stays outside the key, so a mistake in the connected tool cannot reach it.

After Create key, select Test the connection under Connection check. It returns the connection's name, environment, permissions, restrictions, expiry, and quota windows, which is the record of what that key can do. Read it before you hand the key to anyone.

Permissions are not the only gate. Every request also rechecks the admin who created the key, the community's status and plan, the key's expiry, and its quotas, so a key with the right permissions can still stop working for another reason. Rotate or revoke an API key covers those.

When you bind a webhook endpoint to a named connection, the endpoint's permissions and courses cannot exceed that connection's grants, and the form says so. Invitation and post events only reach an endpoint that is bound to a named connection. So the permissions you choose on the key set the ceiling for what any endpoint tied to it can deliver. Receive webhooks from your Locker has the endpoint side.

Rotating a key keeps the connection's identity, so drafts, invitations, and webhook bindings made through it stay attributed to it. Permissions are fixed when the key is created, and rotation keeps them as they were. To change what a tool can reach, create a new key with the right permissions, move the tool onto it, and revoke the old one.