Developer Portal and External API: Create and Manage API Keys

Overview

The Developer Portal lets account owners and Admin users create and manage API keys for the zenloop External API. Use these keys for server-to-server integrations with systems such as a CRM, data warehouse, or internal reporting service.

The portal is available only when the Developer Portal feature is enabled for your organization. If you have the required role but cannot see it, contact your zenloop representative to ask about availability.

This guide covers the zenloop External API. It does not confirm whether an existing Classic API integration or credential can be reused.

Open the Developer Portal

Log in to zenloop.
Open zen 2.0 in the main navigation.
Select Developer Portal.

You can also open the portal directly at /developer after signing in.
The portal contains three sections:

API Keys for creating, rotating, and revoking keys.
Audit log for reviewing key lifecycle and failed-authentication events.
API Documentation for viewing the External API documentation in Swagger, ReDoc, or OpenAPI format.

Only account owners and users with the Admin role can access the current Developer Portal.

Create an API Key

Open the API Keys section.
Select Create API key.
Enter a name that identifies the integration.
Add an optional description.
Choose Live or Test as the intended environment label.
Select Create API key.

The environment selection changes the key prefix to zlk_live_ or zlk_test_. It identifies the intended use of the key, but it does not by itself create a separate data set. Access remains controlled by the organization and the key creator's survey permissions.

Save the API Key

After creation, zenloop shows:

Key ID, which is the short identifier used in the portal and audit log.
API Key, which is the complete secret used to authenticate API requests.

The complete API key is shown only once. Copy it into an approved password manager or secrets vault before selecting I've saved it.
zenloop stores a cryptographic hash of the key and cannot display the complete secret again. If the secret is lost, rotate the key or create a new one.

Make an API Request

Send the API key as a Bearer token in the Authorization header.
Use the API host shown in the API Documentation section. External API paths begin with /api/external/v1.
Example request:

curl -H "Authorization: Bearer zlk_live_YOUR_KEY" \
  "https://<api-host>/api/external/v1/surveys"

Never place an API key in a survey URL, browser-side script, shared document, or support ticket.

Available Operations

The External API currently provides these operations:

Method	Path	Purpose
`GET`	`/surveys`	List surveys visible to the API key.
`GET`	`/surveys/{survey_id}/answers`	Retrieve active responses and their survey-question metadata.
`GET`	`/surveys/{survey_id}/properties`	List response properties used by the survey.
`POST`	`/surveys/{survey_id}/answers/{answer_id}/properties`	Add or replace properties on an existing response.
`GET`	`/survey-groups`	List survey groups and visible member surveys.

The API Documentation section is the authoritative source for request parameters, response formats, pagination, and error responses.

Rotate an API Key

Open the API Keys section.
Find the active key.
Select the rotate action.
Save the new secret when it is displayed.
Update the integration to use the new secret.

The Key ID remains the same. The previous secret remains valid for 24 hours after rotation so the integration can be updated without an immediate interruption.

Revoke an API Key

Revoke a key when an integration is no longer used or when its secret may have been exposed.

Find the key in the API Keys section.
Select the revoke action.
Confirm the revocation.

Revocation is immediate and cannot be undone. Requests using the revoked key will fail.

Review the Audit Log

The Audit log records events such as:

key creation
key rotation
key revocation
failed authentication

Entries can include the event time, actor, affected Key ID, and IP address. Repeated failed-authentication events can indicate an outdated, revoked, or incorrectly copied key.

Access and Limits

An API key can access only the organization in which it was created.
Survey access follows the key creator's current zenSurveys permissions.
The default limit is 25 active API keys per organization.
The default rate limit is 60 requests per minute per key.
API keys are secrets and should be stored outside application source code.
Create a separate key for each integration so it can be rotated or revoked independently.

Classic API Integrations

Do not assume that a Classic API credential or endpoint works with the External API.
Before changing a live Classic integration, ask your zenloop contact to confirm the migration scope, replacement endpoints, authentication requirements, timing, and support path.

Frequently Asked Questions

I lost the complete API key. Can zenloop show it again?

No. Rotate the existing key to generate a new secret with the same Key ID, or create a new key.

Why can I not see the Developer Portal?

The feature may not be enabled for your organization, or your user may not be an account owner or Admin.

What is the difference between the Key ID and API Key?

The Key ID identifies the key in the portal and audit log. The complete API key is the secret sent in the Authorization header.

Should I use one API key for every integration?

Use a separate key for each integration. This lets you rotate or revoke one integration's access without interrupting the others.

Support Centre