Skip to main content

Open in AthenaHQ

app.athenahq.ai/settings/api

​
Purpose

The API Settings page allows customers to manage programmatic access to their organization’s data. From this page, customers can generate and revoke API keys, access integration guides for Looker Studio and Model Context Protocol (MCP), and configure iframe embed credentials to display the dashboard within their own applications.

​
What’s on the page

View-only banner If a user lacks permission to manage API keys, a banner reading “View-only · API” appears at the top of the page. Hovering over it displays the tooltip: “Ask an org admin for API write access to make changes here.”

​
API keys tab

Header Controls
  • Key Count: Displays the total number of keys (e.g., “3 keys”).
  • Guides dropdown: A menu offering quick setup instructions for specific integrations.
  • Create API Key button: Opens the dialog to generate a new key.
API keys table Lists all existing API keys the user has permission to view.
  • Name: The display name given to the API key.
  • Key: A preview of the key, showing the prefix followed by a masked suffix (e.g., sk_live_••••••).
  • Websites: Displays which websites the key is authorized to access. It shows an “All Websites” badge for global keys, a “None” badge for empty scopes, or up to 4 website logos. If there are more than 4, a +N overflow chip appears (hovering shows a tooltip with the remaining website names).
  • Created: The date the key was generated.
  • Created By: The email address of the user who generated the key.
  • ... (Actions menu): A kebab menu on the far right of each row containing Edit and Delete actions.
Locked / Empty States
  • Locked API Upsell: If the customer’s plan does not include API access, the entire panel is replaced by a “Put your AthenaHQ data to work” upsell. Depending on their role, they will see a Subscribe button (which opens a live quote and checkout flow) or a Contact Team button.
  • Empty State: If the organization has API access but no keys exist, an illustrated card reads “Create your first API key” with a primary Create API Key button.

​
Embed tab

Allowed domains
  • A section listing all web domains permitted to embed the dashboard via iframe.
  • Add Domain button: Opens a setup wizard to authorize a new domain.
  • Domains List: Shows the authorized domain URL and the date it was “Added”. Each row has a ... menu with a Delete action.
Embed tokens
  • A section listing the secure tokens used by the customer’s backend to authenticate embed sessions.
  • Create Token button: Opens a dialog to generate a new token.
  • Tokens List: Shows the token’s name, a status badge (“Active” or “Paused”), and “Last used [date]” (or “Never used”). Hovering the row reveals the creation date. Each row has a ... menu with Pause (or Unpause) and Delete actions.
How to embed Athena An expandable accordion at the bottom of the tab containing reference documentation. It includes the exact HTML <iframe ...> snippet, a breakdown of required URL parameters, and a backend Node.js code example for signing a JWT.

​
What you can do here

  • Create an API key: Click Create API Key. In the dialog, name the key. If you are an org admin, you can choose “All websites” or “Specific websites” (and pick from a list). Clicking Create key reveals the secret token once so you can copy it.
  • Edit an API key: Open the ... menu on an API key row and select Edit to rename the key or change which specific websites it can access.
  • Delete an API key: Open the ... menu on an API key row and select Delete. A confirmation dialog appears. Deleting a key immediately permanently revokes it.
  • Access Integration Guides: Click Guides to open a dropdown.
    • Select MCP setup to open instructions for connecting Claude.ai or another MCP client.
    • Select Looker Studio setup for instructions on connecting Looker Studio dashboards.
    • Select API documentation to open the external developer docs in a new tab.
  • Add an Embed Domain: On the Embed tab, click Add Domain. Enter the domain (e.g., example.com), then proceed to automatically generate an embed token and JWT secret for that domain.
  • Create an Embed Token: On the Embed tab, click Create Token. Name the token. A dialog will display the Embed Token and JWT Secret once for copying.
  • Pause / Unpause an Embed Token: Open the ... menu on an embed token row and select Pause to temporarily disable it (breaking live embeds using it). Select Unpause to restore access.
  • Delete a Domain or Token: Open the ... menu on the respective row and select Delete.
  • Copy credentials: Click any code block displaying a token or JWT secret to instantly copy it to your clipboard. A “Copied!” tooltip confirms success.
  • Buy API Access: If the feature is locked and the user is an admin, clicking Subscribe (or Get API access) opens a quote dialog showing the prorated amount due today. Confirming the purchase will either charge their card on file or route them to a Stripe checkout page.

​
Data shown

  • API Keys: Shows keys belonging to the user’s organization. If the user is an external member (only invited to specific websites), they only see the keys scoped to the websites they have permission to access.
  • Embed Domains and Tokens: Shows all domains and tokens configured for the organization’s embeddable dashboard.
  • Subscription Quotes: For users purchasing API access, the dialog fetches live, prorated pricing data from the billing system based on their current plan cycle.

​
Common workflows

Creating an API key for a specific website
  1. Ensure you are on the API keys tab and click Create API Key.
  2. Enter a descriptive name for the key.
  3. Under “Access scope”, select Specific websites.
  4. Check the boxes next to the websites this key should be allowed to access.
  5. Click Create key.
  6. Click the generated key string to copy it, and store it safely. Click Done.
Setting up a new embed dashboard
  1. Click the Embed tab.
  2. Click Add Domain.
  3. Type the domain where the iframe will be hosted (e.g., internal.mycompany.com) and hit Enter or click Add Domain.
  4. In the “Domain Added” step, click Create Token.
  5. The “Embed Ready” screen appears. Click to copy your Embed Token, JWT Secret, and the Iframe Example snippet.
  6. Pass these credentials to your development team alongside the JWT signing instructions found at the bottom of the Embed tab.

​
Empty, loading, and error states

  • Loading: While the page checks permissions and fetches data, a centered animated spinner is displayed. If just the API keys or Embed lists are fetching, “Loading domains…” or “Loading tokens…” text may appear.
  • Empty API keys: If no API keys exist, an illustrated card appears titled “Create your first API key” with a description of what they can be used for.
  • Empty Embed lists: If no domains are added, a globe icon is shown with “No domains added yet”. If no tokens exist, a key icon is shown with “No tokens created yet”.
  • Errors: Attempting to create, edit, or delete items and failing will display a red toast notification at the top of the screen (e.g., “Failed to update API key”). If the live billing quote fails to load during a purchase attempt, the dialog shows “Couldn’t load pricing right now. Please close this and try again.”
  • Linked from: The main Settings navigation menu (Settings > API). Users can also be directed here by clicking a locked “API” badge in the main sidebar if they are on a Free plan.
  • Links to:
    • API documentation: Opens docs.athenahq.ai in a new tab.
    • Contact Team: Opens a Cal.com booking page in a new tab for sales/support.
    • Claude.ai and Model Context Protocol: External links found within the MCP setup guide.
    • Stripe Checkout: If a user without a card on file attempts to subscribe to API access.

​
Common support questions

Why is the “Create API Key” button disabled? The button will be greyed out if you do not have write permissions for the API. Hovering over the button will display “Only admins can create API keys.” You must ask an organization administrator to grant you api:write access or have them create the key for you. I lost my API key / JWT secret. How do I see it again? For security reasons, secret keys and tokens are only displayed once immediately after creation. If you lose a key, you must delete it (or pause it, in the case of embed tokens) and generate a new one. Can I limit an API key to just one website? Yes. When creating or editing an API key, select “Specific websites” under the Access scope section, and check only the website(s) you want that key to access. Why can’t I click anything on this page? It just shows a lock screen. API access is a paid feature. If you are on the Free plan, the entire page is restricted behind a “Put your data to work” lock screen. An organization admin must upgrade the plan to unlock these settings.