Read-only access for a tool you choose
An API key lets a connected tool read selected Accrue progress or records through the REST API. It does not let the tool add, edit, or delete your entries. API Keys is in the browser app's Settings area, separate from the screens where you work with records. Read the current details at the API reference.
In the browser app, open Settings → API keys to manage keys. Sign in with your Accrue account; keys require progress access and can also include records access for a tool that needs entries, sites, supervisors, or tasks. Grant only the access the tool needs.
Create and store a key
- Open Settings → API keys and choose a short name that tells you which tool or purpose it is for.
- Select progress access and add records access only if needed.
- Choose an expiry period shown on the API keys page.
- Create the key and copy it into the trusted tool's protected secret store while it is displayed. Accrue cannot show the full value again after you leave that screen.
- Confirm that the API keys page lists the new key and its scope and expiry.
Treat the full key like a password. Do not paste it into a public chat, support ticket, source file, spreadsheet, shared document, or URL. If you lose it, create a replacement and revoke the old key.
Review and revoke access
The API keys page lists a key's name, scope, creation and expiry dates, and recent use when available. Check the list periodically. Revoke a key when you stop using its tool, no longer trust the destination, or suspect it was copied. A revoked key stops authorizing API reads; issue a new one only after you have secured the destination.
Keep account sign-in credentials separate from API keys. You manage the key from Settings; an API request sends it as a bearer credential in its authorization header. Never place it in a query string or share it in a screenshot.
Know what the tool can see
Progress access returns ledger readings. Records access adds the record collections described in the API reference. Connected reads use the latest account snapshot available to the server; a freshness timestamp does not prove every device has synced. Check sync status and freshness before relying on a remote result.
The API is read-only and its output is a recordkeeping aid. It does not establish board, school, or supervisor acceptance. Review the data the destination will retain, and do not connect tools that you do not trust with your training records.