API Client Management
Enterprise tier. Create API keys for external integrations. Configure client name, permissions, and allowed tenants. Integrator docs live at /docs/developers.
API Client Management
API client management lets CrystalQore operators create and manage API keys for external integrations. External systems can use these keys to access CrystalQore APIs for automation, reporting, custom applications, and third-party integrations. This is an Enterprise tier feature.
Overview
With API client management you can:
- Create API keys — Generate keys for external applications
- Configure permissions — Control what each client can access
- Restrict by tenant — Limit API access to specific tenants
- Manage keys — Rotate, revoke, or disable keys as needed
- Open integrator docs — Developers and the API playground
Creating an API Client
Navigate to Superadmin → API Clients — Open the API client management page.
Click Create API Client — Start the creation form.
Enter client name — A descriptive name (e.g., "CRM Integration", "Reporting Dashboard").
Configure permissions — Select which API scopes or endpoints the client can access (users, cdr, contacts, click2dial, chat, files, calendar, fax, presence).
Set allowed tenants — Restrict access to specific tenants, or allow all.
Save — Generate the API key. Copy and store it securely — it is not shown again in full.
Required Configuration
| Field | Description |
|---|---|
| Client name | Identifier for the integration (for your reference) |
| Permissions | API scopes or endpoints the client can call |
| Allowed tenants | Tenant(s) the client can access; "all" or specific list |
API Key Format
Keys use a prefix you can recognize in logs:
- Full key:
cq_followed by 64 hexadecimal characters - A short prefix identifies the client in logs and audit trails
- Store the full key securely; do not share or commit to version control
API keys are shown only at creation time. Store them in a secure vault (for example environment variables or a secrets manager). If lost, regenerate the key and revoke the old one.
Permissions
Permissions determine what the API client can do. Grant the minimum a given integration needs. See Permissions for the flag-to-endpoint map.
Tenant Restrictions
You can restrict API clients to specific tenants:
- All tenants — Client can access data across all tenants (use sparingly)
- Specific tenants — Client can only access the listed tenants
Tenant restrictions help maintain multi-tenant isolation when integrating with external systems.
Managing Access
- Disable — Temporarily revoke access without deleting the client
- Revoke/Rotate — Invalidate the current key and generate a new one
- Delete — Remove the client and all associated keys
Integrator documentation
Public API documentation (no Superadmin login required):
- Developers — Authentication, errors, pagination, recipes
- API playground — Try every documented call against the live API
- OpenAPI 3.1 spec — Download for codegen and API clients
The tenant must also have the platform.api entitlement.
Best Practices
- One client per integration — Do not reuse keys across multiple systems
- Least privilege — Grant only the permissions needed
- Tenant scoping — Restrict to specific tenants when possible
- Rotate keys periodically — Replace keys on a schedule or when staff changes
- Monitor usage — Use audit logs to detect unusual API activity
Related Documentation
| Page | Description |
|---|---|
| Developers | REST API guides and playground |
| Audit Logs | Track API client usage |
| User Management | User-based access vs. API access |