Set up API access
Overview: set up API access
The company API area lets Admin users create API keys and OAuth clients so external systems, scripts, or internal tools can call CxPlanner over HTTPS, which is used for integrations that need read, write, or global project access.
For assigning an API user to a project, see Add an API user to a project.
- Your role must be company Admin.
- You can find the menu at profile icon - Company profile - API.
- This creates or revokes credentials that can access company and project data.
Secrets are shown only once. Non-global integrations need project membership for the API user. Global access covers all company projects without per-project setup.
How to set up API access
Open the API keys page
- Sign in to CxPlanner and click your profile icon.
- Go to Company profile.
- Click API.
Create a new API key or OAuth client
- Click Generate API key at the bottom of the screen.
- In Create new API key, enter an API name.
- Choose an API type.
- Choose an API scope.
- Click Save.
Store credentials securely
- Identify the credential type created.
- For a static API key, copy the secret from the dialog.
- For OAuth types, copy Client ID and Client Secret.
- Store them in your secret manager before closing the dialog.
Manage existing credentials
- Open the table on the API keys page.
- Review Name, Scope, Type, Last used, and Used (count).
- Locate the key or client to remove.
- Click Delete.
- Confirm in the Delete API key dialog.
Grant project access for scoped API users
- Confirm the integration uses a non-global scope.
- Identify the API user (
apiservice+<unique_id>@cxplanner.com). - Open each relevant project.
- Add the API user with a suitable project role.
- Match the role to what the integration needs.
Results: API access
Authentication types
Authentication type | Use case | How it works | Typical usage |
|---|---|---|---|
Static API key | System-to-system | Send key in header, for example | Simple integrations |
OAuth (API user) | System-to-system | Use client_id and client_secret to obtain Bearer tokens (client_credentials) | Standard secure integrations |
OAuth PKCE (individual user) | User-delegated | User logs in and approves access, then API uses a Bearer token | User-based integrations |
Scope behavior
Scope (create dialog) | Table label | Access |
|---|---|---|
Developer READ API | READ ONLY | Read access only |
Developer READ-WRITE API | READ and WRITE | Read and write access |
Developer Global API | GLOBAL | Access to all company projects |
Project access rules
Scope type | Project access required | Result |
|---|---|---|
READ API | Yes | Can read data in assigned projects |
READ-WRITE API | Yes | Can read and write in assigned projects |
GLOBAL | No | Access to all company projects |
Troubleshooting: set up API access
Problem | Cause | Solution |
|---|---|---|
API menu is missing | API module not enabled, or role is below Admin | Ask a Company Admin to enable the API key module or raise your role to Admin |
Cannot click Generate API key | API feature not enabled for the company | Ask a Company Admin or CxPlanner Support to enable the API key module |
Error opening the API page | Account is not company Admin | Sign in with a Company Admin account |
Integration cannot access a project | API user not added, or wrong scope | Add the API user to the project and confirm the key scope |
Lost API secret | Secrets are shown only once | Create a new key, update integrations, delete the old key |
Integration cannot write data | Read-only scope selected | Create a key with Developer READ-WRITE API scope |
Integration cannot access all projects | Not using global scope | Create a key with Developer Global API scope, or add the API user to each project |
Updated on: 07/26/2026
Thank you!