Keys and review

A key lets a program act for you. Which kind you get depends on what the program needs to do, and some permissions are checked by a person at Bynefit before the key is released.

Pick the right kind

Kind	What it can do	Where
Developer key `bapi_pk_…`	Read public community data and submit resources for review. Anyone with an account can make one, instantly, without a Space.	/dash/developers/keys
Space key `bapi_tk_…`	Work with your own Space's data, receive webhooks. A Space admin makes it, and some permissions need review first.	/dash/integrations/api-tokens
Browser key `bapi_pk_…` from your Space	Loads your Space's embed widget on your own website. It is safe to put in a web page because it can do nothing else, and it only works on the websites listed under Embeds.	/dash/integrations/api-tokens, then Create key and choose Run in a visitor's browser
Test key `bapi_tk_test_…` or `bapi_pk_test_…`	Answers like a Space key or a developer key, with sample data. Ready straight away with any permission, including changing a directory, because nothing it does reaches real information. See Test mode.	Either page above, then Create key and choose Test
Agent key `bapi_ag_…`	A key made for an AI agent. It reads only what you tick, expires within 90 days, starts in its own test mode (a smaller daily ceiling on real information, not the sandbox), and lists every call. The agent asks for anything more and its owner decides. A Space manager or admin makes it. How agent keys work.	/dash/integrations/agent-keys Available

Not sure which one you need? Reading data from a server takes a Space key. Running in a visitor's browser takes a browser key. An AI agent reading your Space takes an agent key. Receiving events takes a webhook and its signing secret, not a key.

Older embeds use a widget key that starts with wk_, shown masked on /dash/integrations/embeds. Widget keys were switched off on 20 October 2026, so move embeds to a browser key or a Space key with the widget permission. See Migrating from the legacy endpoint.

Handing a key to an AI agent? Make it an agent key, not a Space key: it is named after the agent, runs out on its own, and you can pause it in one click. For the public directory alone, a developer key named after the agent works too. Building with an AI agent has the rest.

When a permission needs review

Some permissions reach sensitive data or let a key change things. When you ask for one, the page asks what the key is for, in at least 20 characters. Bynefit reviews the request, usually within one business day, and emails you when it is approved. The key itself is withheld until then, and you collect it on the same page once it is approved.

Test keys skip the review. Make one with the same permission and build against sample data while the live request waits.

A request waiting for review is not an error. The page shows it as waiting. Nothing about the key changes until a person at Bynefit has looked at it.

Keep a key safe

The full key is shown once, when you create it. Put it in an environment variable such as BYNEFIT_API_KEY and keep it out of your code.
Use one key per program, with a name that says which one, so a leak is easy to trace and easy to end.
Never paste a key into a support message. Name the key instead, and we can find it.

Revoke a key

Open the page where you made the key and choose Revoke on its row. An agent key can also be paused, which stops it at once and can be undone by its owner. Revoking ends access immediately and cannot be undone, and any program still using the key starts getting 401 errors. Make a new key and update the program.

Next steps

Make your first call with a developer key.
Authentication shows how to send the key.
Webhooks use a signing secret instead of a key.