Credentials

Four credentials connect your systems to JustAI. A JustAI API key authenticates your data. An Iterable API key lets JustAI work in your Iterable project. A feed token and a system webhook header secure the two connections between JustAI and Iterable. Each credential has a different owner and lives in a different place.

Summary

Credential	What it does	Created in	Who handles it	Where it lives
JustAI API key	Authenticates requests to the Identify, Track, and Profiles APIs.	JustAI, in Settings > API keys	Engineering	Your servers, CDP, or warehouse tool
Iterable API key	Lets JustAI create campaigns and templates, set up the system webhook, and trigger sends in your Iterable project.	Iterable, on the API keys page	Marketing	JustAI, on your Iterable connection
Feed token	Lets Iterable fetch each prepared message from JustAI through the content data feed.	JustAI, on your Iterable connection	Marketing	Iterable, on the content data feed
System webhook header	Lets JustAI accept the send and engagement events that Iterable reports.	JustAI writes it into Iterable for you	Handled by JustAI	Iterable, on the system webhook

The content data feed is the Iterable data feed that fetches each message’s prepared content from JustAI when Iterable sends. The system webhook is the Iterable webhook that reports sends, opens, clicks, bounces, and unsubscribes back to JustAI. Connect Iterable explains both.

JustAI API key

A JustAI API key authenticates every request to the Identify, Track, and Profiles APIs.

Property	Value
Where to create it	Settings > API keys in the account menu, then New key
Who can create it	Any member of your organization, after your JustAI team turns on API access for your organization
Format	Starts with jai_
When you can see it	Once, in the API key created dialog. The key list shows only a suffix, such as xxxxx1a2b3.
Environment	The environment selected when you created the key. The key works only in that environment.
Scopes	None. One key works with every supported JustAI API in its environment.
Where to keep it	A secrets manager, or the credential settings of your CDP or warehouse tool

If you select New key and JustAI shows “API key creation is restricted for this environment. Ask an organization admin for help.”, contact your JustAI team to turn on API access for your organization. An admin in your company cannot turn it on.

Create a key

1. At the bottom of the left sidebar, check the environment shown under your name.

   If it is not the environment that the key is for, open the account menu, select Environment, and select Switch next to that environment.

2. Open the account menu and select Settings > API keys.

   The page description names the environment, for example “API keys for the Production environment.”

3. Select New key.

   The API key created dialog shows the full key.

4. Select Copy, and store the key in your secrets manager.

5. Select Done.

   The list shows the new key with status active. JustAI never shows the full key again.

A new key may not work immediately. Confirm it succeeds before switching traffic to it.

Rotate a key

Create the replacement before you revoke the old key, so that your data keeps flowing.

1. Create a new key in the same environment.

2. Update every system that uses the old key, such as your backend, CDP destinations, and warehouse syncs.

3. Confirm that requests with the new key succeed. A 200 or 202 from the data APIs confirms it.

4. In Settings > API keys, select the trash icon in the old key’s row.

   A dialog asks “Revoke key” followed by the key’s suffix.

5. Select Revoke.

   The old key shows status revoked. Revocation cannot be undone. Confirm that requests with the old key are rejected.

If a key is exposed

Revoke an exposed key right away, even before its replacement is in place. Any key works with every supported JustAI API in its environment, so a leaked key exposes all of them.

What breaks when the key is wrong

Problem	Response
No key in the request	401 with {"error":"Missing API key"}
Unknown or revoked key	401 with {"error":"Invalid API key"}
Key from another environment or organization	403 with {"error":"Forbidden"}

In each case, JustAI saves no profile update or event from that request.

Iterable API key

The Iterable API key lets JustAI act in your Iterable project. JustAI uses it to set up the system webhook, to create the templates and triggered campaigns for each sending profile, to trigger sends, and to show message previews.

Property	Value
Where to create it	Iterable’s API keys page. The API keys in Iterable link on your Iterable connection opens it.
Key type	Server-side, with full read and write access. Read-only keys and client-side keys for mobile or JavaScript do not work.
Project	One Iterable project in Iterable’s US data center. Each JustAI connection holds one key, so it belongs to one project.
Who creates it	Your Iterable admin, who has permission to manage API keys in your Iterable project
Where it lives	On your Iterable connection in JustAI, in Settings > Integrations

To save the key, open your Iterable connection, paste the key into API key, and select Verify. When JustAI shows “Key verified. Save to keep it.”, select Save API key. Verify confirms that Iterable accepts the key. It does not check write access, so always create the key with full access. Add your Iterable project has the full procedure.

Connect each Iterable project to only one JustAI connection, in one environment. A second connection to the same project can take over the first connection’s system webhook.

Rotate the Iterable key

Create a new server-side key with full access in the same Iterable project. Paste it into API key on your Iterable connection, select Verify, and then select Save API key. Confirm sends succeed with the replacement before revoking the old key in Iterable. Revoke the old key only after JustAI saves the new one. Rotate the API key has the full steps and the messages JustAI shows when it refuses a replacement key.

What breaks when the Iterable key is wrong

• Verify fails with a message that starts “Verification failed:”. Check for a mistyped key, a client-side key, or a project outside Iterable’s US data center.
• A key without write access can pass Verify and then fail when you select Set header on the system webhook, or Create profile on a sending profile.
• A key that you revoke in Iterable before you save its replacement stops JustAI from triggering sends. Journey messages and test sends through that connection fail.

Feed token

The feed token lets Iterable fetch each prepared message from JustAI through the content data feed. JustAI generates it, and you paste it into Iterable.

Property	Value
Where to create it	Your Iterable connection in JustAI, in the Content data feed step. Select Generate token.
When you can see it	Only right after you generate it. JustAI does not show it again.
Who handles it	The person who sets up the Iterable connection
Where it lives	In Iterable, in the Authorization token field of the JustAI content feed data feed

The feed token is not a JustAI API key. It works only for the content data feed. Set up the content data feed has the full procedure.

Rotate the feed token

Caution

The current feed token stops working as soon as you generate a new one. Until you paste the new token into Iterable, Iterable cannot fetch content, and messages are not sent. Rotate the token when few messages are sending, and paste the new token right away.

Open JustAI content feed in Iterable first. Then select Generate a new token in the connection’s Content data feed step, copy the new token, paste it into Authorization token in Iterable, and save the data feed. Replace the feed token has the full steps. If you lose a token before you paste it, generate a new one and paste that one instead.

What breaks when the feed token is wrong

Iterable cannot fetch the prepared content, so the message is not sent. The Content data feed step in JustAI still shows as complete, because the step tracks only that a token was generated. If a test email from a sending profile does not arrive after you change the token, check the token in Iterable first.

System webhook header

The system webhook header authenticates every call that Iterable’s system webhook makes to JustAI. JustAI creates the header value and writes it into your webhook when you select Set header or Update header on your Iterable connection. You never see or copy the value.

Property	Value
Where it is created	JustAI creates it the first time you select Set header on the connection.
Who handles it	JustAI. You start the write with Set header or Update header.
Where it lives	In Iterable, as a custom header on the system webhook
Iterable’s Authentication setting	Stays None. The header authenticates the calls.

Do not edit or remove the header in Iterable. Set header rewrites the webhook’s endpoint and custom headers, so use a webhook dedicated to JustAI. Set up the system webhook has the full procedure.

Restore the header

The header has no rotation control. Set header and Update header write the same value again. If the header was edited or removed in Iterable, or the webhook’s endpoint changed, restore it:

1. In JustAI, open your Iterable connection in Settings > Integrations.

2. In the System webhook step, select Verify.

3. Select Set header or Update header, whichever one JustAI shows.

   The step summary reads Webhook #<id>.

If you think the header value was exposed, contact your JustAI team.

What breaks when the header is wrong

JustAI refuses Iterable’s webhook calls. Sends, opens, clicks, bounces, and unsubscribes stop appearing in JustAI analytics. The System webhook step still shows as complete, because JustAI cannot read the header back from Iterable. If engagement stops arriving, restore the header.

Security practices

• Store the JustAI API key and the Iterable API key in a secrets manager. Never commit them to source control.
• Never put a JustAI API key in browser, mobile, or other client-side code. Call the data APIs from your servers, your CDP, or your warehouse tool.
• Create a separate JustAI API key for each system that sends data. You can then revoke one key without stopping the others.
• Use a separate environment, with its own keys, for testing.
• Never log an API key. Remove the X-Api-Key and Authorization headers before you log a request.
• Record each JustAI API key’s suffix next to the name of the system that uses it. Settings > API keys lists keys only by suffix, with no name, so the record tells you which row to revoke later.
• Revoke keys that no system uses. Revoke a key right away if it is exposed.
• Limit who can manage API keys, data feeds, and system webhooks in your Iterable project.

Check your credentials

Credential	Check	Expected result
JustAI API key	Read any profile, as shown in Check your credentials.	200, or 404 with {"error":"Profile not found"}
Iterable API key	On your Iterable connection, select Verify in the API key step.	“Key verified. Save to keep it.”
Feed token	Send a test email from a sending profile.	The test email “Confirm your JustAI sending profile” arrives. Iterable fetches its content through the content data feed.
System webhook header	After the first live journey send through Iterable, open the journey’s analytics.	The email step shows the message under Sent.

Next steps

API overviewAuthentication, environments, and request format.

Connect IterableThe API key, content data feed, system webhook, and sending profiles.

Errors and retriesWhat each authentication error means.