How do I let someone create an API key in Synthreo?

In Canopy, open Settings and find the API keys card, then turn on the API keys switch beside that person in the Team members table. It is off by default and no user can create a key until you turn it on.

Does turning someone's API key switch off revoke their existing keys?

No. Turning the switch off stops them creating new keys. Existing keys keep working until each one is revoked individually.

Why can I not see a key I know exists?

The list opens on Active, which hides revoked and expired keys. Select All to see every key on record.

API Keys

Control who in your Synthreo organization can create API keys, and revoke any active key from Canopy. Enablement is opt-in and off by default for every user.

Overview

API keys let your users call Synthreo programmatically. As an administrator you decide who may create keys, and you can revoke any active key. Enablement is opt-in and off by default: a user cannot create a key until you turn it on.

These controls appear in two places, and work the same in both:

Your organization - in Settings, in the API keys card.
A child customer - on the customer’s API Keys tab. See Adding a New Customer.

Enable who can create keys

The top of the card is a Team members table, headed with the number of people in it. Each row is one user, with an API keys switch that reads Enabled or Disabled. The helper text states the rule: “Turn on API keys for a user before they can create one in Threo. Off by default.”

Turning a switch on applies immediately. Turning one off asks you to confirm first, in a dialog titled Disable API keys for this user?

With no users to show, the table reads “No users in this organization.”

Review and revoke keys

Below the roster, keys are grouped by owner, each showing Label, Status, Last used, Expires, and Created. A search box appears once there is at least one key, and filters by owner or key label.

Two buttons above the table decide which keys you are looking at:

Active - the default. Only keys that are still usable.
All - every key on record, including revoked and expired ones.

The heading names the current view and its count, for example “Active keys (12)” or “All keys (31)”.

Each key has a Revoke action, which asks for confirmation and warns that the key “will stop working immediately. This cannot be undone.” The action is greyed out on a key that is already revoked.

A key with an empty Expires column has no expiry date and will not expire on its own. Such a key ends only when it is revoked, so revocation is the only way to retire it.

What a key actually grants

Understanding this makes the revoke decision easier.

A key is not itself a credential for the API. It is exchanged, through the standard OAuth client-credentials grant against auth.synthreo.ai, for a short-lived access token.
That token lasts 15 minutes and cannot be refreshed - the caller exchanges the key again for a new one.
A token minted from a key is refused on the surfaces that could be used to extend its own reach, including creating further API keys.

So the exposure window after you revoke a key is bounded by that 15-minute token life, not by the key’s own expiry date. The security of the arrangement rests on revoking promptly, which is why the Revoke action takes effect immediately.

Integrators can find the exact request shape in API Authentication.

Settings - where your organization’s API key controls live
Adding a New Customer - the per-customer API Keys tab