Get an API key
Open Dashboard → Settings → API access and submit your use case and expected volume. An administrator reviews every request before API or MCP credentials can be created or used. This manual gate protects the redirect network from automated spam and helps keep legitimate links deliverable.
After approval, return to the same page, give the credential a useful name, click Create key, and copy the gtn_… value when it appears; only its hash is stored and the value is not shown again. If access is later revoked, all active credentials are revoked immediately.
Authenticate with Authorization: Bearer gtn_YOUR_KEY. Keep the key in a server-side environment variable or secret manager, never in browser JavaScript. Each key can be revoked independently from the same Settings page. Only verified, active accounts can use API keys.
Link requests are limited to 120 per minute per key and conversion events to 240 per minute. Redirect traffic is unaffected by API limits.
A key layout that survives production
Create one credential per workload, not one immortal credential for the whole company. Names such as production-order-sms, staging-cms, and analyst-backfill-october make the revocation list understandable six months later. Staging should have its own key even if it writes to the same GoTo.now account. When an employee, contractor, or vendor no longer needs access, revoke the specific credential they used; other systems keep running.
Put the value in your platform's secret facility: a deployment secret in GitHub Actions, an encrypted variable in your host, or a secrets manager entry read by the backend at startup. Do not paste it into a public repository, mobile application, browser extension, shared screenshot, support ticket, or spreadsheet cell. The browser network panel exposes client-side headers, so a frontend is never a safe home for a bearer credential.
What the key can and cannot do
The key belongs to one verified GoTo.now account. It can list that account's recent links, create new links, configure smart routing, and record conversions only against links owned by the same account. It cannot access another user's inventory. Dashboard password and two-factor settings are not API operations. Raw visit records are outside the current public surface.
If a key is exposed
Open Settings, revoke it immediately, then create a replacement with a new name. Update the affected service and inspect its logs for unexpected link creations. A revoked value returns HTTP 401 and cannot be restored. Because stored values are hashed, support cannot reveal a lost key; replacement is the correct recovery path.
First-request checklist
Before building a batch job, make one request with cURL from a trusted machine. Confirm that the response is JSON, the new link appears in your dashboard, and your secret has no trailing newline. A 401 usually means the Bearer prefix is missing, the value was copied incompletely, the key was revoked, API access is no longer approved, or the account email still needs verification. A 429 means the caller should pause and retry with backoff rather than opening parallel workers.