Skip to main content

​
Two Key Types

Parallel AI offers two types of API keys to fit different use cases. Understanding which to use will keep your integrations secure and maintainable.

​
Company API Key

A Company API Key is scoped to a single company workspace. When you use this key, all API calls automatically operate within that company’s context — no extra headers needed. Best for:
  • Server-side integrations tied to one company
  • CI/CD pipelines and deployment automation
  • Third-party apps that connect to a single workspace

​
Personal Access Key (pak_)

A Personal Access Key is tied to your user account and works across every company you belong to. All Personal Access Keys begin with the prefix pak_. Because they aren’t scoped to a single company, you must specify which company you want to act on by passing a X-Company-ID header (or companyId query parameter) with each request. Best for:
  • Multi-company dashboards and admin tooling
  • Personal automation scripts
  • Local development where you switch between workspaces
Personal Access Keys inherit your user-level permissions. If your account is removed from a company, your Personal Access Key will immediately lose access to that company’s resources.

​
Getting a Company API Key

1

Log in to your dashboard

Visit https://web.parallellabs.app and sign in to your account.
2

Navigate to the Integrations page

From the left sidebar, click Integrations.
3

Generate a new key

Find the API Keys section and click Generate New Key. Give it a descriptive name so you can identify it later.
4

Copy and store your key

Copy the key shown in the dialog. This is the only time it will be displayed — store it securely in a password manager, secrets vault, or environment variable before closing.

​
Using a Company API Key

You can pass your Company API Key in one of two ways:

​
Getting a Personal Access Key

1

Log in to your dashboard

Visit https://web.parallellabs.app and sign in to your account.
2

Open your profile

Click your avatar or profile icon in the top-right corner and select Profile.
3

Find Personal Access Keys

Scroll to the Personal Access Keys section on your profile page.
4

Create a new key

Click Create New Key. Give it a descriptive name (e.g. local-dev or multi-company-script). Optionally, set an expiration date to automatically revoke the key after a set period.
5

Copy and store your key

Your new key — beginning with pak_ — will be displayed once. Copy it now and store it securely. It won’t be shown again.

​
Using a Personal Access Key

Personal Access Keys must be accompanied by a company identifier so the API knows which workspace to act on. You can pass your PAK using either the Authorization header or the X-API-Key header, and supply the company context via the X-Company-ID header or companyId query parameter. Option 1 — Authorization header with X-Company-ID (recommended):
Option 2 — X-API-Key header with X-Company-ID:
Option 3 — companyId query parameter:
The X-Company-ID header approach is preferred for production use — it keeps your company ID out of server logs and browser history that may record request URLs.

​
Finding Your Company ID

You need your Company ID when using a Personal Access Key. You can find it in two places:
  • Dashboard URL — when you’re viewing a company in the dashboard, the company ID appears in the URL (e.g. https://web.parallellabs.app/companies/YOUR_COMPANY_ID/...).
  • Settings page — navigate to your company’s Settings page; the Company ID is listed there and can be copied directly.

​
SSO Login

Enterprise customers can authenticate through their organization’s identity provider using Single Sign-On (SSO). Navigate to https://web.parallellabs.app/login/sso and enter your company domain to be redirected to your SSO provider. Contact your Parallel AI account manager to enable SSO for your organization.

​
Security Best Practices

API keys grant access to your company’s data and resources. Treat them like passwords.
  • Never commit API keys to source control. Use environment variables or a secrets manager instead. Add .env to your .gitignore.
  • Rotate keys immediately if exposed. If a key is accidentally published or shared, revoke it in the dashboard right away and generate a replacement.
  • Use environment variables in your code:
  • Give keys descriptive names. Names like production-crm-integration or ci-deploy-pipeline make it easy to identify the purpose of each key and safely revoke the right one if needed.
  • Set expiration dates on Personal Access Keys when you only need them for a limited time — for example, a temporary migration script.
  • Apply least privilege — use Company API Keys for integrations scoped to a single workspace rather than Personal Access Keys with broader access, wherever possible.