Back to Help Centre

API Keys

Generate API keys to build custom integrations, automate workflows, and connect Chronos to your own systems.

By Byte Size Labs · Updated 21 April 2026

API access is available on the Teams plan and above. Upgrade in Settings › Billing to unlock this feature.

Generating an API Key

  1. Go to Settings › API Keys
  2. Click Generate New Key
  3. Name the key

    Use a descriptive name that identifies its purpose — e.g. “Zapier integration” or “Internal dashboard”.

  4. Copy and store the key securely

    The full key is only shown once at creation. Store it in a password manager or secrets vault — you cannot retrieve it again.

Authenticating API Requests

Include your API key in the Authorization header as a Bearer token on every request:

# Example request

curl https://api.chronos.app/v1/tasks \

-H "Authorization: Bearer YOUR_API_KEY"

Common endpoints

  • GET/v1/tasks — list tasks
  • POST/v1/tasks — create a task
  • PATCH/v1/tasks/:id — update a task
  • GET/v1/events — list calendar events
  • GET/v1/projects — list projects

Full API reference is available in the developer documentation. Contact support for access.

Webhooks

Webhooks let Chronos push real-time event notifications to your server whenever something happens — a task is created, completed, or a booking is made.

Setting up a webhook

  1. Go to Settings › API Keys › Webhooks
  2. Click Add Webhook
  3. Enter the URL of your endpoint (must be HTTPS and publicly accessible)
  4. Select the events to listen for (e.g. task.created, task.completed, booking.created)
  5. Save — Chronos sends a test request to verify the endpoint

Available events

  • task.created — a new task was added
  • task.updated — a task was modified
  • task.completed — a task was marked complete
  • booking.created — a booking was made via a booking link
  • booking.cancelled — a booking was cancelled

Managing API Keys

  • Revoke a key: Immediately invalidates the key — any systems using it will lose access. Use this if a key is compromised.
  • Rotate a key: Generate a new key with the same permissions, then update your systems before revoking the old one.
  • Multiple keys: Create separate keys for each integration — easier to track usage and revoke individual access without disrupting others.
Security best practices:
  • Never commit API keys to source control — use environment variables or a secrets manager
  • Use one key per integration so you can revoke access selectively
  • Rotate keys periodically, especially after team member offboarding
  • Monitor your webhook delivery logs for unexpected failures that might indicate a misconfigured endpoint

Related articles

Need more help? Contact support or return to help centre