API keys and integrations
Issue API keys to integrate external applications that submit or read the channel’s reports.
An API key is a secret credential that lets an external application (e.g. an HR suite, a customer portal or the company intranet) talk to your whistleblowing channel automatically, without going through the web interface.
What it is for
With an API key a third-party system can submit new reports or read the metadata and status of the channel’s reports. It is meant for server-to-server integrations: never use it from a public browser nor embed it in web pages or client-side apps.
How to create and revoke it
- Open the channel from the manager console (/gestore) and go to the “API & Integrations” section.
- Give the key a recognisable name (e.g. “HR portal integration”) and select the permissions (scopes) you need.
- Create the key: it will be shown ONLY once. Copy it immediately and store it in a secrets manager.
- To disable it, use “Revoke”: any integration using it stops working immediately. To rotate a key, create a new one, update the client and revoke the old one.
Available permissions (scopes)
- reports:submit — submit new reports to the channel.
- reports:read — read report metadata (list), never the plaintext content.
- status:read — read the status of a report via its receipt code.
Zero-knowledge: the API never exposes the plaintext content of reports. It returns only metadata, status and encrypted data (ciphertext); decryption happens exclusively in the manager’s browser with the private key.