API keys

API keys let you authenticate programmatic requests to the Pivra API from your own server, scripts, or automation tools. They are separate from the embed key used by the chat widget.

Available on: Starter plan and above.

---

Creating an API key

1. Go to Settings → Security
2. Scroll to the API Keys section
3. Enter a label (e.g. "Zapier integration", "CRM sync", "Internal dashboard")
4. Click Create
5. Copy the key immediately — it is shown only once and cannot be retrieved again

Store the key in a secure location such as your server's environment variables or a secrets manager. Never commit it to version control.

---

Using your API key

Pass the key in the Authorization header on every request:

Authorization: Bearer pivra_sk_xxxxxxxxxxxxxxxxxx

Example using curl:

curl https://pivra-api.fly.dev/api/leads \
  -H "Authorization: Bearer pivra_sk_xxxxxxxxxxxxxxxxxx"

---

Available endpoints

The Pivra API is a REST API. Common use cases:

Full API reference documentation is coming soon. In the meantime, the endpoints follow the same structure as the dashboard — reach out to support@pivra.ai for specific integration help.

---

Revoking a key

1. Go to Settings → Security → API Keys
2. Find the key by its label
3. Click Revoke
4. Confirm — the key stops working immediately

Any integration using that key will fail until you replace it with a new one. Create the new key first, update your integration, then revoke the old one to avoid downtime.

---

Security best practices

• One key per integration — use separate labelled keys so you can revoke one without breaking others
• Rotate keys periodically — create a new key, update your integration, then revoke the old one
• Never expose keys client-side — API keys are for server-to-server use only. The chat widget uses a separate public embed key
• Restrict to your server IP where possible — IP allowlisting is on the roadmap

---

Frequently asked questions

How many API keys can I create? There is no hard limit. Create as many labelled keys as you need for different integrations.

Is the API key the same as the embed key? No. The embed key (shown in Install → Embed code) is a read-only public key for the chat widget. API keys are secret and provide full read/write access to your account data.

Can I use the API to send messages to my chatbot programmatically? Not yet — the chat endpoint is designed for real-time widget use. Programmatic chat via API key is on the roadmap.