API keys and secrets

An API key lets another system — your website, your CRM, a script — use HelloCall without a person signing in: place calls, read call history, manage workflows, campaigns and parties.

1. 1 Open Settings → API keys and press New key (admins only).
2. 2 Say What is it for? — for example “Website booking form” — and add notes if useful.
3. 3 Choose the Access: Full access — read and write, or Read only — GET requests.
4. 4 Choose Expires after (days) — 0 means never.
5. 5 Press create. The key is shown once: Copy it and store it somewhere safe.

The list shows each key’s name and first characters, its access, when it was Last used and its status. Revoke stops a key immediately and keeps a record of it; Delete removes it from the list. Access and expiry cannot be changed after creation — make a new key instead.

The API lives under /api/v1 on the address you use for the console. Send the key in a header, either Authorization: Bearer hck_… or X-API-Key: hck_…. Requests and replies are JSON; a reply carries data and a readable message, and list endpoints take offset, limit and search.

• GET /api/v1/phone-numbers — your numbers and their ids.
• POST /api/v1/calls with phoneNumberId, to and optionally workflowId — place a call from a Plivo number (without workflowId, the number’s outgoing workflow runs). A 402 means the wallet is too low.
• GET /api/v1/calls?phoneNumberId=… and GET /api/v1/calls/{id} — history and a call’s full record.
• /api/v1/campaigns, /api/v1/scheduled-calls, /api/v1/parties, /api/v1/workflows — the same things the console manages.

A read-only key gets 403 on anything but GET; a revoked, expired or unknown key gets 401. Keys can never manage users, billing, other API keys or secrets.

The secret store keeps other systems’ API keys and tokens, encrypted, so a Call an API step can use a credential by name without it ever sitting in a workflow, a transcript or a log.

1. 1 Open Settings → Secret store and press Store a secret (admins only).
2. 2 Give it a Name — letters, digits and underscores, for example crm_api_key.
3. 3 Paste the Value, add notes if you like, and save.
4. 4 In a Call an API step, write {{crm_api_key}} where the credential goes — for example the header Authorization: Bearer {{crm_api_key}}.

The value is added only at the moment the request is sent and is never shown again. Edit replaces it (leave the value blank to keep the current one) from the next call on; Copy reference copies {{name}}; Last used tells you whether a workflow is using it.