API keys

An API key lets another system, such as your CRM or a script, call the FormWork REST API on behalf of your account. Only admins can see, create and revoke keys.

Create a key

1. Go to Account settings > API keys and select New API key.
2. Enter a Key name that says what uses it, for example “CRM sync (production)”. Each active key in the account needs a different name.
3. Under Access, choose Full access or Choose permissions and projects. For chosen access, tick the permissions and choose All projects (including future projects) or Chosen projects, then tick the projects.
4. Select Create key.
5. Select Copy and store the key somewhere safe, such as your system’s secret store. Then select Done.

The full key is shown once. FormWork keeps only a hash of it, so it can’t show it again. If you lose it, create a new key and revoke the old one.

Keys look like fwk_ followed by an ID and a secret.

Use a key

Send the key as a bearer token, and send your account ID in the X-Account-ID header on every request. Your account ID is the first part of the address when you are signed in to FormWork, for example app.useformwork.com/<account-id>/.

curl "https://app.useformwork.com/api/v1/projects" \
  -H "Authorization: Bearer fwk_..." \
  -H "X-Account-ID: <account-id>"

The account ID must be the account the key belongs to. Otherwise the request is refused with 403. A missing, wrong or revoked key returns 401.

See the REST API for the endpoints.

What a key can do

A key acts as the admin who created it, within its chosen permissions and projects:

• Changes made with the key are recorded against that person.
• If that person is removed from the account, the key stops working.
• If that person becomes a Member, the key loses the admin-only permissions listed in Team members and roles.

Full access lets the key do anything its creator can do in the account. Existing keys keep full access.

Choose permissions and projects can limit a key to reading setup or entries, editing drafts, publishing and live settings, changing entries, or creating projects. The permissions use the same labels as assistant connections. For read-only reporting, grant See entries and their history and only the projects needed.

Permission to change includes permission to see. Publishing permission includes reading setup, but does not include editing drafts. Scoped keys can’t manage account membership, keys or billing; those operations need full access and the appropriate role.

The key list shows its permissions, project access and when it was last used. To change a key’s access, create a replacement and revoke the old key.

A key is not used to fill in a form. Respondents’ sessions use a separate entry key in the X-Formwork-Entry-Key header. See the REST API.

Use a key with an assistant

Developer tools can use the same key with FormWork’s MCP server. See Connecting an assistant. The account’s AI setting applies to MCP calls, even with a full-access key, but not to ordinary REST API requests.

Revoke a key

1. In API keys, open the menu next to the key and select Revoke.
2. Select Revoke key to confirm.

Anything using the key stops working straight away, and a revoked key can’t be restored. The list keeps the key with a Revoked badge.

Keep keys safe

• Use one key for each system and environment, so you can revoke one without breaking the others.
• Keep keys out of source code, browser code, screenshots and support messages.
• To rotate a key, create a new one, update the system that uses it, check it works, then revoke the old key.
• Remove people promptly when they leave. Their keys stop working when they are removed.