Skip to navigation

Release Notes

October 20, 2026

Viewer seats can no longer create API keys

Updated: POST /api-keys

Users with a Viewer (view-only) seat in the selected company now get a 403 from POST /api-keys and its legacy alias GET /token, and no key is created. Office and Field seats are unaffected.

  • The seat checked is the one in the company the key is for: the company_id you pass, or your default company. A user who is a Viewer in one company and an Office user in another can still create keys for the second company.
  • Keys that Viewer users created before this change keep working. A superadmin can find them with GET /api-keys and delete them with DELETE /api-keys/{key_id}.