Freshdesk API key: read-only, KB-only access

Your Freshdesk API key is in Profile settings, under "View API key", and it carries exactly the permissions of the agent it belongs to. To give a tool knowledge-base access only, create a dedicated agent with a role limited to Solutions and use that agent's key, not your own.

This guide shows where the key is, how to limit it, how to test it with one read-only call, and how to revoke it.

Where is my Freshdesk API key?

1. 01

   Sign in as the agent whose key you need

   Each agent has their own key. The key only appears once the agent has verified their email address.
2. 02

   Open Profile settings

   Click your profile picture in the top-right corner and choose Profile settings.
3. 03

   View the key

   In the right-hand pane, click View API key and complete the captcha. Copy the key and store it in a password manager, not in a chat or a ticket.

Freshdesk's help article states that "any activities via API are allowed as per the role assigned to the agent". The API reference says the same: what you can reach depends on the permissions of your user profile.

• How to find your API key
• Freshdesk API v2 reference: authentication and permissions

Checked 2026-09-19 · Freshdesk support article and API reference

Why not use your own admin key

An admin's key can do everything the admin can: read tickets and contacts, change automations, delete data. A third-party tool that only needs the knowledge base should not hold that.

A dedicated agent gives you three things:

• A smaller blast radius. If the key leaks, it reaches the knowledge base and nothing else.
• A clean audit trail. Every change made through the key shows the dedicated agent as the editor, so you can tell tool edits from people's edits.
• Revocation without side effects. Resetting your own key disconnects every app that uses it. Deactivating a dedicated agent affects one tool.

Create a knowledge-base-only role

Roles control what an agent, and therefore their API key, can do. In most accounts they live under Admin → Team → Roles (older accounts may show Admin → Agents → Roles). Custom roles are not available on every plan; if you can't add a role, check your plan in Admin → Account.

Create a new role, for example "KB bot", and give it only the knowledge-base permissions:

The exact permission names vary between Freshdesk versions. Freshdesk's public docs we checked don't list them, so match the intent: view Solutions, optionally edit, nothing else.

A key with only "view" permissions is a true read-only key. Anything that edits articles needs edit rights, so keep two agents if you want scans and fixes separated.

Create a dedicated agent

1. 01

   Add the agent

   Go to Admin → Team → Agents → New agent. Use a shared mailbox you control, such as kb-bot@yourcompany.com, so the key doesn't depend on one person's account.
2. 02

   Assign the role

   Pick the "KB bot" role you created. Leave groups empty; the agent has nothing to do with tickets.
3. 03

   Verify and sign in

   Accept the invitation from the shared mailbox, set a strong password, and turn on two-factor authentication if your account uses it.
4. 04

   Copy the key

   As that agent, open Profile settings → View API key, as in the first section.

Test the key with a read-only call

Before you paste the key into any tool, check what it can see. This call lists your solution categories and changes nothing:

curl -s -u "YOUR_API_KEY:X" \
  "https://yourcompany.freshdesk.com/api/v2/solutions/categories"

The key is the username and X is a dummy password. A JSON list of categories means the key can read the knowledge base.

Then confirm it can't read tickets:

curl -s -o /dev/null -w "%{http_code}\n" -u "YOUR_API_KEY:X" \
  "https://yourcompany.freshdesk.com/api/v2/tickets"

A 403, or a 200 with an empty list [], is what you want. If tickets come back, the agent can still see them. Remove ticket permissions from the role and set the agent's ticket scope to the narrowest option (restricted to tickets assigned to them). We haven't verified which combination returns 403 on every Freshdesk plan, so trust the result of this call over the settings screen.

Every call counts against your account's per-minute limit (100 on Growth, 400 on Pro, 700 on Enterprise), shared with all your integrations. Two test calls won't matter.

Revoke it any time

You have two ways to cut a tool off, and they differ in scope:

1. Deactivate or delete the dedicated agent. The key stops working at once, and nothing else is affected. This is the cleanest option.
2. Reset the agent's API key in Profile settings. Freshdesk notes that resetting disconnects every app using that key, so only the tools you give the new key reconnect.

Review the agent's role once a quarter. Roles tend to grow permissions over time, and a KB-only key should stay KB-only.

If you are connecting a key so a tool can change articles in bulk, read how to replace text in multiple Freshdesk articles first, including what to do before any write.

Freshdesk and Freddy are trademarks of Freshworks Inc. TidyKB is an independent product and is not affiliated with, endorsed or sponsored by any company named on this page.