How to get a HeyGen API key and store it safely
An API key is a credential, not a public project ID. Find it in the account that owns the videos, confirm current API access requirements, and never paste it into an untrusted form or public repository.
HeyGen’s current help documentation directs users to Settings → API → API token. Copy the token only into a trusted client, password/secret manager, or local extension storage. HeyGen controls API access and credit requirements separately from the browser product, so verify the current status shown in your account.
Find the API token in HeyGen
- Sign in to the HeyGen account or workspace that owns the target videos.
- Open Settings.
- Choose the API area.
- Locate the API token/key control and follow the account prompts to create or reveal it.
- Copy it once into its approved destination and close the settings page.
Interface wording can change. Use HeyGen’s current help or dashboard instructions if the menu differs. Do not use a video ID, share URL, or account password in place of the API key.
Web-app access and API access are not the same thing
A HeyGen subscription does not automatically make every API operation free or unlimited. HeyGen documents API pricing and credits separately, and account-level requirements can change. Check the API section before designing a workflow that must run unattended.
For a downloader, listing and retrieving completed file URLs is different from generating new videos. Confirm what your workflow calls and monitor the account’s current API limits rather than relying on an old tutorial’s pricing statement.
Treat the key like a password
| Destination | Appropriate? | Note |
|---|---|---|
| Environment secret / secret manager | Yes | Best for code and automation |
| Trusted extension local storage | Sometimes | Review privacy policy and permissions |
| Shared spreadsheet or chat | No | Easy to leak and hard to audit |
| Public Git repository | No | Assume immediate compromise |
| Client-side website source | No | Visitors can inspect it |
A browser extension should explain whether the key stays in Chrome and which domains receive it. For GrabKit’s downloader, the key is stored in Chrome and used for direct requests to HeyGen rather than a GrabKit product server.
Test with the least expensive read operation
Before starting hundreds of downloads, ask the client to list a small page of videos. HeyGen’s current List Videos endpoint uses the x-api-key request header and accepts a page limit. Confirm that the response belongs to the intended account and that completed records contain usable URLs.
Never paste a real token into online request examples, screenshots, support posts, or AI chats. Replace it with a marker such as <HEYGEN_API_KEY>.
Common authentication and access failures
- 401/unauthorized: re-copy the token without spaces, confirm the expected header, and check whether it was revoked.
- 403/forbidden: the account or workspace may lack access to that operation.
- 429/rate limited: pause and retry with backoff; do not create a tight request loop.
- No videos: verify that the key belongs to the workspace containing the projects.
- Browser request blocked: review extension host permissions and security software.
- Old results: check pagination rather than assuming the first page is the full library.
Rotate the key after exposure or team changes
If a token appears in logs, a public commit, a screenshot, or a departed contractor’s environment, revoke or replace it in HeyGen and update every approved client. Removing it from the public location is not enough because copies may already exist.
Once connected, follow the bulk-download guide or compare implementation choices in API vs CLI vs extension.