If you want portfolio data in your own tools rather than in the product, the
Vein API reads the same figures programmatically. Keys are issued
from the API Keys panel on your Settings page.
This panel is investor-side and requires the partner role or above. It does not
appear on a company’s Settings page at all; see
roles and permissions. Issue one
Open API Keys in Settings
The panel lists every key your firm has issued, each with its scopes and its
status. A revoked key stays listed rather than disappearing, so the record of
what once had access survives.
Name it after where it will live
The name is only for you, and its whole job is to make a key identifiable
months later when you are deciding whether it is still needed. “Production
integration” or “Ben’s reporting script” is useful; “API key 2” is not.
Choose test or live
Test keys are for building against. Reach for a live key once the thing
you are building is actually running.
Select scopes
Each scope grants read access to one kind of data, and the key can do nothing
outside the ones you tick:Everything the API offers is read-only; there is no scope that writes. Tick
only what the integration needs. A script that charts runway does not need
sources:read, and narrowing the key now limits what a leaked key exposes
later. Copy the key immediately
The full key is shown once, at the moment it is created. Vein stores a
hash rather than the key itself, so nobody, including us, can show it to
you again.Copy it into wherever it is going before closing the dialog. If you lose it,
revoke the key and issue another; there is no recovery path.
Put the key in your secret manager or environment variables, never in a
committed file. Anyone holding it can read everything its scopes allow, for as
long as it is live.
Revoking
Revoke from the same panel. It takes effect immediately and cannot be undone.
Calls made with that key start failing at once, so revoke the key of a departing
colleague or a retired script rather than leaving it live.
Revoking one key never affects another. Issuing a separate key per integration is
worth the small extra effort, because it means you can retire one without
breaking the others.
What a key does not grant
A key reads what your firm can already see in the product. It does not widen your
access: a company whose data you cannot read in the Portfolio is not readable
through the API either, and consent still gates the whole thing.
Access to a company’s ongoing data is granted by that company, not by a scope.
See request data access for how to ask, and the
authentication reference for how consent surfaces in API
responses. 
