API Key Management

Manage your API keys from the Developer Portal. You can create, view, and revoke keys at any time.

Accessing the Developer Portal

You can access the Developer Portal in two ways:

• From the Popp Dashboard — click the <> developer icon in the top navigation bar at ai.joinpopp.com
• Direct link — go to app.joinpopp.com/developer/keys

Creating an API Key

1. From the API Keys page in the Developer Portal, click Generate API key

2. Enter a name for your key (e.g., production-key, staging-key)
3. Choose an expiry:
   • On a date — select a specific expiration date
   • Never — the key will not expire automatically
4. Click Generate new key

5. Copy your key immediately — this is the only time the full key will be displayed

⚠️

Important: Once you close the dialog, you will only see a masked version of your key (e.g., ...********abcd1234). Store your key securely before closing.

Viewing Your Keys

The API Keys page displays all your keys with the following information:

You can search keys by name and filter by status using the toolbar.

Copying Your Organization ID

Your Organization ID is required alongside your API key for every API request. Click Copy Organization ID in the toolbar to copy it to your clipboard.

Key Statuses

Each key has a status derived from its current state:

Revoking a Key

If a key is compromised or no longer needed, you should revoke it:

1. Click the key name or the three-dot menu on the key row
2. In the key detail panel, click Revoke API key
3. Confirm the revocation in the dialog

⚠️

Warning: Revoking a key is permanent. Any application using the revoked key will immediately receive 401 Unauthorized errors.

Rotating a Key

To rotate a key without downtime:

1. Create a new key using the steps above
2. Update your application to use the new key
3. Verify your application works with the new key
4. Revoke the old key

Security Best Practices

• Never expose keys in client-side code — API keys should only be used in server-side applications
• Use environment variables — store your key in environment variables (e.g., POPP_API_KEY), not in source code
• Set an expiry — use expiring keys where possible to limit the impact of a leaked key
• Use descriptive names — label keys by their environment or purpose (e.g., production-main, staging-ci) so you know what to revoke if needed
• Rotate regularly — periodically create new keys and retire old ones
• Revoke unused keys — remove keys that are no longer in use

Using Your API Key

Include your API key and Organization ID in the headers of every request:

curl -X GET "https://api.joinpopp.com/v1/conversations" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-organization-id: YOUR_ORGANIZATION_ID" \
  -H "Content-Type: application/json"

For full authentication details, see the Authentication guide.