Skip to main content

Key Types

Parallel AI supports two types of API keys:
Company API Keys are scoped to a specific company account. You can find and create them on the Integrations page in your Parallel AI dashboard. Use these for server-side integrations where all requests belong to one company.
Personal Access Keys are tied to your user account and can act on behalf of any company you belong to. Create them on your Profile page. Every request made with a PAK must also include an X-Company-ID header to identify which company context to use.

Programmatic Key Management

You can manage Company API Keys via the /api/v0/api_keys endpoints. This is useful for automated provisioning and multi-tenant setups.

List Keys

GET /api/v0/api_keys — Retrieve all API keys associated with a company. Pass the companyId as a query parameter:
Response:

Create a Key

POST /api/v0/api_keys — Create a new API key with a descriptive name. Both companyId and name are required:
Response:
Copy the returned apiKey value immediately — it will not be displayed again after this response.

Get a Specific Key

GET /api/v0/api_keys/{companyId}/{name} — Retrieve a single key by company ID and key name:
Response:
Returns 404 if no key with that name exists for the given company.

Create or Get Existing Key (Upsert)

PUT /api/v0/api_keys — Create a key if it doesn’t exist, or return the existing one if it does. This is ideal for idempotent provisioning scripts that run on every deployment:
Response:

Delete a Key

DELETE /api/v0/api_keys — Permanently delete a key by passing the company ID and key name in the request body:
Deleting an API key is permanent and cannot be undone. Any integration using the deleted key will immediately stop working.

Security Best Practices

Name each key after its use case (e.g. crm-sync, marketing-automation, staging-tests). This makes it easy to audit which systems have access and revoke individual keys without disrupting others.
Periodically replace active keys — especially after team member offboarding or a suspected exposure. Use the upsert endpoint to provision a new key, update your integration, then delete the old one.
Never hard-code API keys in your source code. Load them from environment variables or a secrets manager at runtime:
Add your .env file to .gitignore and audit your repository history if you suspect a key was accidentally committed. Treat any exposed key as compromised and rotate it immediately.

Learn More