Creating and revoking API keys

An API key lets an external system reach your Learnient account without a person signing in. It belongs to the account rather than to you, so it keeps working when you leave.

What a key can do is described in the Learnient Public API documentation: every endpoint, the fields it returns, how to send the key with each request, and the errors to expect. Webhooks, for being told when something changes, have their own webhook reference.

Where it is

Choose Admin, then Developer in the left-hand menu and API keys.

Creating one

1. Choose New API key.
2. Give it a name. Name it after the system that will use it, not after yourself — the name is how you will know which key to revoke in two years.
3. Create it, and copy the key immediately.

The key is shown once

The full key is returned when you create it and is never stored. Learnient keeps a hashed version to check against, so nothing can show you the key again — not the screen, not support, not the database.

The list shows a masked fragment, enough to tell two keys apart and not enough to use.

So paste it into wherever it is going before you close the dialog. If you lose it, the only path forward is revoking the key and creating another, which means updating whatever was using it.

What the list tells you

Name, the masked key, Status, Last used and Created.

Last used is the column worth reading. A key with no last-used date is one nothing has ever authenticated with — usually a setup that was never finished. A key last used months ago is a candidate for revoking, and checking that before an audit asks you is the cheaper order.

Revoking

Revoking stops the key working. It moves to the Revoked tab, where it stays as a record of what existed rather than disappearing.

Revoke immediately if a key has been committed to a repository, pasted into a ticket, or shared with somebody who has left. There is no way to rotate a key in place — you create the new one, move the integration across, then revoke the old one, in that order so nothing is down in between.

Keys can also expire

A key can carry an expiry date, after which it stops working without anybody revoking it.

Use it for anything temporary — a migration, a contractor’s script, a trial integration. A key with an end date is one you cannot forget to clean up.

If you are pointing a tool at the API

The screen suggests pointing an AI coding tool at llms.txt rather than at the documentation. That file describes the API in a form a model reads more reliably than prose, and it is the faster route to a working integration.