How to create REST API keys in Braze

Step 1: Find to API settings

The first step to creating a REST API key in Braze is to find your way to the menu.

‍

‍

• Navigate to Settings. You can find it in the bottom left menu.

• Select APIs and Identifiers. Click on APIs and Identifiers. This is where you create and manage API keys.

• NOTE: If you are still using the legacy navigation, go to Developer Console > API Settings.

‍

Step 2: Create a new API key

Once you're in the API settings, you can proceed to create a new API key.

‍

• Click on "Create API Key: You will see the "Create API Key" button on the top right. Click on it to start creating the key.

• Give your API key a name: Give the API key a descriptive name, such as "Campaign Engagement Data" or "Data Export Key". As usual, a clear name will help you and others understand and easily navigate the system.

• Specify Allowlisted IP addresses and Subnets: If necessary, specify the IP addresses or subnets that should have access to the API key. Allowlisting IP addresses means that only specific IP addresses can use it. This is important if you want to ensure that only trusted networks, like your company server, can access the API. Once you've created an API key, you can't change allowlisted IPs or permissions. So if you later want to change these, you will need to create a new key and replace the old one.

‍

Step 3: Define permissions

The next step is to define the permissions for the API key. This is done in the same menu as the previous steps.‍

Available categories of permissions, you can expand these to see all specific permissions and explanation.

• Assign permissions based on requirements: On the same page you can also assign permissions. That is, what access to the system's parts and functions the API key should have. Choose permissions such as users.track or users-delete, depending on which functions the key should have access to. You can read more about what all these mean here.

• Use the principle of least privilege: assign only the permissions needed for the task. This reduces the risk of a key getting out of hand. Why? Think of it this way: Instead of losing a key that unlocks every room in your house, you've only lost the key to the bathroom in the basement. In other words, things could have been worse.

• Important: After a new API key has been created, you cannot change permissions or allowlisted IPs. If changes are needed, create a new key with new permissions and replace the old one. Then delete the old key.‍

• Click on "Save:": After selecting the permissions, click Save. The REST API key will now be available under Identifier and looks like this e.g. "abc123gh-5678-9ijk-lmno-pqrs90tu1234"

Step 5: Integrate your API key with your application

Finally, you can use the just created API key in your desired application or integration.

‍

Tip 1: Use a descriptive naming convention

To avoid confusion in the future, use a consistent "naming convention" for your API keys. As usual when creating a naming convention, make sure to involve everyone who will work with it in the process, anchor it and maintain it.

Tip 2: Review permissions regularly

Regularly review the permissions associated with your API keys to ensure they are consistent with current needs. Remove keys that are not used and keep track so that other users do not create keys with too broad permissions.

‍