Skip to content

API Keys

Overview

If a third-party application needs to read or write data in CiviCRM, then you may need to generate an API key.

Each API key is attached to a specific contact record or user account which determines the permissions. When configuring a new application, you should determine the contact ID and double-check their roles or permissions.

Each API key must be unique and difficult to guess. To generate a good API key, use a random sequence of 20+ alphanumeric characters.

Assigning keys

Assuming you have identified a suitable contact record, you may assign a key through any of the following tools:

"API Key" Extension

The optional API Key Extension provides a simplified web interface for managing keys.

API Key Extension

APIv3 Explorer

The "APIv3 Explorer" provides a powerful, built-in way to manipulate CiviCRM data through the administrative web-site.

See "Stack Exchange: How do I set up an API key for a user?"

CLI

If you have shell access and cv, then you can generate and assign API keys:

  1. Generate a random key:

    head -c32 /dev/urandom | base64 | tr -d '+/='
    
    T0PS3CR3T6ateeUXgTOJ9e3PpXvDZF9Al55WAmBsNQI
    

  2. Assign this new value to the contact. In this example, we update contact #100:

    cv api contact.create id=100 api_key="T0PS3CR3T6ateeUXgTOJ9e3PpXvDZF9Al55WAmBsNQI"
    

MySQL

If you have direct access to the MySQL database, then you can generate and assign API keys:

  1. Generate a random key:

    SELECT @api_key := REPLACE(REPLACE(REPLACE(
      TO_BASE64(RANDOM_BYTES(32)), "+", ""), "/", ""), "=", "") AS api_key;
    
    +---------------------------------------------+
    | api_key                                     |
    +---------------------------------------------+
    | T0PS3CR3T6ateeUXgTOJ9e3PpXvDZF9Al55WAmBsNQI |
    +---------------------------------------------+
    

  2. Assign this new value to the contact. In this example, we update contact #100:

    UPDATE civicrm_contact SET api_key = @api_key WHERE id = 100;