Skip to main content

​
Access Keys

Access keys are your credentials for authenticating with the ZeroForms API. They are used to identify your application and grant access to your forms and submissions.

​
What is an Access Key?

An access key is a unique token that allows your application to:
  • Create and manage forms
  • Submit form data
  • Retrieve submissions
  • Configure webhooks
  • Access analytics
Access keys typically look like: zf_live_abcdef123456... or zf_test_xyz...

​
Key Types

​
Live Keys

Production keys for live environments:
  • Prefix: zf_live_
  • Use for real form submissions
  • Full production rate limits apply

​
Test Keys

Development keys for testing:
  • Prefix: zf_test_
  • Isolated from production data
  • Higher rate limits for testing

​
Creating an Access Key

1

Log in to Dashboard

Go to app.zeroforms.dev and sign in.
2

Navigate to Settings

Click Settings in the left sidebar.
3

Go to Access Keys

Select Access Keys from the settings menu.
4

Generate New Key

Click Generate New Key and give it a descriptive name.
5

Copy and Save

Copy your key and store it securely. You won’t see it again!

​
Best Practices

​
Security

Never Commit Keys

Use environment variables, not hardcoded values in source code.

Rotate Regularly

Generate new keys every 90 days and retire old ones.

Scope by Purpose

Create separate keys for different applications or features.

Monitor Activity

Check API logs for unusual access patterns.

​
Organization

Create keys with descriptive names: 
Production API
Staging Backend
Mobile App
Slack Integration
Zapier Automation

​
Managing Keys

​
Viewing Keys

curl https://api.zeroforms.dev/api/keys \
  -H "x-access-key: your-key"

​
Regenerating a Key

If you suspect a key is compromised, regenerate it immediately. Any applications using the old key will lose access.
  1. Go to Settings → Access Keys
  2. Find the key you want to regenerate
  3. Click Regenerate
  4. Confirm the action
  5. Update all applications with the new key
  6. Delete the old key
Regenerating a key immediately invalidates the old key. Make sure all applications are updated before regenerating.

​
Deleting Keys

Remove keys you no longer need:
  1. Go to Settings → Access Keys
  2. Click the Delete button
  3. Confirm deletion

​
Permissions

Each access key can have limited permissions:
PermissionDescription
forms:readList and view forms
forms:writeCreate and modify forms
forms:deleteDelete forms
submissions:readView submissions
submissions:exportExport submission data
webhooks:*Manage webhooks
analytics:readView analytics
By default, all permissions are granted. Contact support for scoped access.

​
Using Keys in Applications

​
Node.js / JavaScript

const accessKey = process.env.ZEROFORMS_ACCESS_KEY;

const response = await fetch('https://api.zeroforms.dev/api/forms', {
  headers: { 'x-access-key': accessKey }
});

​
Python

import os
access_key = os.getenv('ZEROFORMS_ACCESS_KEY')

headers = { 'x-access-key': access_key }
response = requests.get('https://api.zeroforms.dev/api/forms', headers=headers)

​
Environment Variables

# .env
ZEROFORMS_ACCESS_KEY=zf_live_your_key_here

​
Rate Limits

Rate limits are applied per access key:
PlanRequests/Hour
Free100
Pro10,000
EnterpriseCustom
When rate limited, you’ll receive a 429 response: 
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again in 60 seconds."
}

​
Troubleshooting

​
”Invalid Access Key”

  • Copy the key exactly (no extra spaces)
  • Verify the key hasn’t been deleted
  • Check that it’s the correct key for your environment

​
”Access Denied”

  • The key doesn’t have permission for this operation
  • Request higher permissions from your account owner
  • Generate a new key with broader permissions

​
”Key Expired”

  • Your key was regenerated or deleted
  • Generate a new key in the dashboard

Security Guide

Learn security best practices for managing access keys.