API keys and access
Create, view and revoke API keys, and give each key only the access it needs.
API keys are created under Forbindelser → API og webhooks ("Connections → API and webhooks"). Only administrators can see the tab and create or revoke keys. Both creating and revoking a key are written to your company's log.
Create a key
Click Opret nøgle (Create key).
Enter a Name that says where the key is used, for example "Web shop" or "Claude".
Choose when it expires: never, or in 30, 90 or 365 days.
Tick the access the system needs — and nothing more.
Click Opret nøgle and copy the key right away.
The key is shown only once. We don't store it — only a fingerprint of it — so we can't find it again either. If you've lost it, revoke it and create a new one.
A key looks like this: tln_live_ followed by 40 letters and digits. The list only shows the beginning, for example tln_live_AbC1x2…, so you can recognise it.
Access
| Access | Allows |
|---|---|
henvendelser:read | Reading inquiries and email threads |
henvendelser:write | Creating, updating and replying to inquiries |
kontakter:read | Reading contacts |
kontakter:write | Creating and updating contacts |
opkald:read | Reading Noa's calls with transcript and summary |
viden:write | Adding knowledge for Noa |
noa:read | Seeing Noa Voice's status and number |
If a key calls an endpoint it doesn't have access to, Telenoa answers 403 with the code mangler_adgang.
Replies sent with a key
When a system sends a reply to a customer (POST /henvendelser/{id}/svar), the email goes out from your company's email account in the name of the administrator who created the key.
If that person is no longer active in the company, the key can't send replies. Create a new key.
The list
For each key you see its name, the beginning of the key, its access, when it was last used, when it expires and who created it. Expired and revoked keys stay greyed out for 90 days.
Revoke a key
Click Tilbagekald (Revoke) next to the key. It stops working immediately, and calls with it get 401.
Always revoke a key if it may have ended up in the wrong hands, or if the person who set up the integration leaves.
Good habits
- One key per system. Then you can revoke one without stopping the others.
- Give only the access that's needed. A dashboard that only shows numbers shouldn't be able to write.
- Keep the key on your server. Never put it in code a browser or app can see.
- Choose an expiry for keys that are only needed for a while.