Skip to main content

Configure API Key Credentials

Configure a Credential that sends an API key in an outbound request header.

Configure API Key Credentials

Use an API Key Credential when the external API expects a fixed authentication value in a request header.

This is common for APIs that ask for a header such as Authorization, x-api-key, Api-Key, or another vendor-specific header name. Payloads stores the header name and value on the Credential, then adds that header when a Payload uses the Credential.

Before you start

Check the external API documentation for the exact header name and value format.

Some APIs expect only the key value. Others expect a prefix such as Bearer, Token, or ApiKey. Enter the value exactly as the API expects it to appear in the request header.

Configure the Credential

Create a Credential from the relevant Integration.

Set Type to API Key.

Enter the Header Name. This is the request header Payloads will send.

Enter the Header Value. This is the authentication value Payloads will place in that header.

Save the Credential and review the Generated Headers section.

An API Key Credential record for Stripe showing an Authorization header and generated header output.

The API Key Credential shows the stored header configuration and the generated header Payloads will apply to outbound requests.

Attach it to a Payload

Open the outbound Payload that should use the key.

Select the Credential in the Payload header fields, then save the Payload.

Do not add the same authentication header again on the Payload's Headers tab. That makes the request harder to review and can produce duplicate headers.

What to check

Before testing, check that:

  • the Header Name matches the external API documentation

  • the Header Value includes any required prefix

  • the Payload has this Credential selected

  • the Payload endpoint points to the API environment that accepts this key

After the first test run, open the Job record and check the response status and response body. If the API rejects the request as unauthorised, check the header name, key value format, and environment.

Did this answer your question?