Skip to main content
API keys let external integration platforms authenticate against Forager on behalf of your company. Today they power the Zapier integration; each key is scoped to your company and can be revoked at any time. If you want to push attestations to a specific CMDB endpoint instead, use Webhook Settings — webhooks push to a URL you provide, while API keys let a platform like Zapier pull samples and subscribe to events itself.

​
Where to find it

In the web dashboard, go to Settings and scroll to the API Keys & Zapier section. You must be logged in as an admin.

​
Generating a key

1

Name the key

Enter a name that describes where the key will be used, e.g. Zapier. The name is only for your reference.
2

Click Generate key

The full key (starting with frg_) is displayed exactly once, in an amber callout. Copy it immediately — after you dismiss the callout or reload the page, only the key’s 8-character prefix is ever shown again.
3

Store it where it will be used

Paste the key into the integration that needs it (for Zapier: the Connect Account dialog in the Zap editor). If you lose a key, revoke it and generate a new one — there is no way to recover the full value.
Forager stores only a cryptographic hash of the key, never the key itself. Anyone with the full key can read your company’s attestation data, so treat it like a password.

​
The key list

Each key row shows:

​
Revoking a key

Click Revoke next to an active key and confirm. Revocation takes effect immediately:
  • The key can no longer authenticate — any integration using it receives 401 Unauthorized.
  • All Zapier subscriptions created with that key are deleted, so any Zaps connected through it stop receiving events at once.
Revocation cannot be undone. To restore an integration, generate a new key and reconnect.

​
Active subscriptions

Below the key list, the Active subscriptions panel shows every live event subscription created through your API keys — one row per Zap trigger that is currently turned on, with the provider, the event it listens for (New Attestation or Mismatch Detected), and when it was created. This list is read-only and maintained automatically: rows appear when a Zap is published or turned on, and disappear when the Zap is turned off, deleted, or its key is revoked. If a Zap has gone silent, this is the first place to check — no row here means Zapier is no longer subscribed.