Key Types
Parallel AI supports two types of API keys:Company API Keys
Company API Keys
Company API Keys are scoped to a specific company account. You can find and create them on the Integrations page in your Parallel AI dashboard. Use these for server-side integrations where all requests belong to one company.
Personal Access Keys (PAKs)
Personal Access Keys (PAKs)
Personal Access Keys are tied to your user account and can act on behalf of any company you belong to. Create them on your Profile page. Every request made with a PAK must also include an
X-Company-ID header to identify which company context to use.Programmatic Key Management
You can manage Company API Keys via the/api/v0/api_keys endpoints. This is useful for automated provisioning and multi-tenant setups.
List Keys
GET /api/v0/api_keys — Retrieve all API keys associated with a company. Pass the companyId as a query parameter:
Create a Key
POST /api/v0/api_keys — Create a new API key with a descriptive name. Both companyId and name are required:
Get a Specific Key
GET /api/v0/api_keys/{companyId}/{name} — Retrieve a single key by company ID and key name:
404 if no key with that name exists for the given company.
Create or Get Existing Key (Upsert)
PUT /api/v0/api_keys — Create a key if it doesn’t exist, or return the existing one if it does. This is ideal for idempotent provisioning scripts that run on every deployment:
Delete a Key
DELETE /api/v0/api_keys — Permanently delete a key by passing the company ID and key name in the request body:
Security Best Practices
Use descriptive, purpose-specific names
Use descriptive, purpose-specific names
Name each key after its use case (e.g.
crm-sync, marketing-automation, staging-tests). This makes it easy to audit which systems have access and revoke individual keys without disrupting others.Rotate keys regularly
Rotate keys regularly
Periodically replace active keys — especially after team member offboarding or a suspected exposure. Use the upsert endpoint to provision a new key, update your integration, then delete the old one.
Store keys in environment variables
Store keys in environment variables
Never hard-code API keys in your source code. Load them from environment variables or a secrets manager at runtime:
Never commit keys to source control
Never commit keys to source control
Add your
.env file to .gitignore and audit your repository history if you suspect a key was accidentally committed. Treat any exposed key as compromised and rotate it immediately.Learn More
- Authentication — how to include your API key in requests
- API Keys Reference — full endpoint documentation
