The Freshdesk API Key
A Freshdesk API key takes thirty seconds to find and it's the single most over-shared secret in most support teams. Both of those facts matter.
Where to find your Freshdesk API key
Sign in as the agent whose key you want, open your profile from the avatar in the top corner, and go to Profile Settings. The API key is displayed on that page, usually in the right-hand panel, sometimes behind a "view" control.
Two things about that screen surprise people.
The key belongs to the agent, not the account. There is no single organisation-wide key. Yours is yours, your colleague's is theirs, and every call you make with your key is attributed to you in ticket history and in the audit trail.
Its permissions are your permissions. The API doesn't grant more than the role does. If your account cannot delete tickets in the interface, your key cannot delete them over HTTP either. That's a feature, and it's the basis of the advice below.
If the key is not visible, you're probably signed in as a contact rather than an agent, or your role has been restricted from viewing it. Both are worth checking before assuming something is broken.
Using it: basic auth, and the X
The pattern is HTTP basic auth with the key as the username and any non-empty string as the password. Everyone writes X because the docs do, but the password is genuinely ignored.
In curl that is -u YOUR_API_KEY:X against a URL like https://yourdomain.freshdesk.com/api/v2/tickets. In a language client you pass a tuple or an auth object with the same two values. If you are building the header by hand, base64 encode the string YOUR_API_KEY:X and send it as Authorization: Basic <encoded>.
The most common failure here isn't an auth failure at all. People base64 the key on its own, without the colon and the password, and get a 401 that reads like a bad key. If a fresh key still 401s, print the exact string you're encoding before you regenerate anything.
A 403 means something different: the key is valid and the role is not allowed to do that. Do not respond to a 403 by making a new key.
Regenerating, and what it breaks
The same Profile Settings screen has a control to generate a new key. It's immediate and there's no grace period.
That is the whole risk. The moment you regenerate, every script, every integration and every colleague quietly using your key starts failing, and because nobody logs 401s prominently, the first symptom is usually a report that stopped updating three days ago.
So before you press it, write down what uses the key. If the answer is "I am not sure", that's exactly the situation the next section exists to prevent.
Regenerate immediately, without ceremony, if a key has been in a screenshot, a support thread, a shared spreadsheet, a public repository or a chat channel with contractors in it. A broken integration is a smaller problem than an exposed key with full agent permissions.
Storage and rotation hygiene
None of this is exotic. It is just rarely done.
If you use single sign-on, note that it governs interactive login and not the key. An SSO-disabled agent may still have a live key, so deactivate the agent properly rather than assuming SSO covers it. More on that in SSO and security.
Frequently asked questions
Is the Freshdesk API key the same as an API token?
Yes. The Freshdesk API token and the API key are the same string, used as the username in Freshdesk basic auth with X as the password. Freshdesk API authentication has no OAuth flow, and a Freshdesk API key regenerate breaks every integration using the old one.
Where do I find my Freshdesk API key?
Open your avatar menu, go to Profile Settings, and the key is shown on that page. It's per agent, not per account, so each agent has a different one.
What is the password for the Freshdesk API?
There is not one. The API key goes in the username position and the password can be any non-empty string. Convention is the single letter X.
Can I have more than one API key?
One per agent. To get separate keys for separate integrations you create separate agent accounts, which also lets you scope each one's role differently.
What happens when I regenerate my key?
The old key stops working immediately with no overlap window. Everything using it starts returning 401, so inventory your integrations before you regenerate.
Why am I getting a 403 instead of a 401?
A 401 means the credentials were rejected. A 403 means they were accepted and the agent role isn't permitted to do that. Fix the role, not the key.
Once your integration is talking
Most teams find their first API project is deduplication. Ticket Merger already does it, on Freshdesk and Zendesk, from $29/month with a 14-day trial and no card.
Start free trial14-day free trial. No credit card required.