Two ways to let a tool act for you
When you connect Google Sheets or MailerLite to an automation tool, you are giving that tool a credential that lets it act on your account without you present. There are two common kinds.
An API key is a long secret string you generate in the app and paste into the automation tool. Whoever holds the string can make the requests it allows, from anywhere, until someone deletes or resets it. Kit, for example, describes API keys as programmatic access to your own Kit account. [6]
OAuth is the "Sign in with Google" style flow. You approve a request on the app's own screen and the app issues the tool an access token. The OAuth 2.0 standard says tokens represent specific scopes and durations of access, granted by the resource owner [1], and a separate refresh token is used to obtain new access tokens. [1] You never hand over your password, and you can usually see and remove the grant from your account settings.
| Question | API key | OAuth |
|---|---|---|
| Who creates it | You, in the app's settings, then paste it into the tool | The app, after you approve a consent screen |
| What it can do | Whatever the app allows that key; MailerLite documents no permission scopes for its tokens [5] | The scopes requested and granted, which may differ from what was asked [2] |
| Expiry | None of the vendor pages cited here state an expiry; treat it as valid until deleted or reset | Access is time-limited [9]; Google refresh tokens can also stop working [2] |
| Where you revoke it | In the app that issued it | In the app's connected-apps page, or by the tool calling a revoke endpoint [3][8] |
| Typical failure | Leaked key works for anyone until rotated | Grant silently lapses and the scenario stops until reauthorized [9] |
Scopes: what you actually grant
A scope is a named permission inside an OAuth grant. The standard expresses it as a space-delimited list of strings. [1] The narrower the scopes, the less a stolen token can do.
In practice the scopes on offer vary widely. beehiiv's OAuth lists read and write scopes for 12 resource types, from subscriptions and posts to segments and webhooks [8], so an app can ask only for subscriptions:read. Kit's OAuth currently has a default scope of public, with fine-grained scopes listed as coming soon. [7] Make's Google Sheets setup for your own Google client has you add the spreadsheets and drive scopes [10], so read what those scopes cover on the consent screen before you approve them.
Google advises apps to request scopes incrementally, at the moment a feature needs them, rather than all at once. [2] As the person approving, read the consent screen: if a tool that only appends rows asks for full Drive access, connect it with a Google account that holds only the automation files.
Why an unscoped API key is the bigger risk
MailerLite's API documentation describes no permission levels for tokens; it only says a 403 means the action is denied for that account or token. [5] What it does offer is an IP allowlist, after which only requests from listed addresses are accepted. [4] So a MailerLite token pasted into an automation tool can do whatever the API allows on that account: read every subscriber, change fields, delete records.
Keys also outlive people. MailerLite says API keys are permanently bound to the user who created them [5], and that even an account admin cannot see tokens created by other users. [4] If a contractor generated the key, you may not be able to see it to revoke it after they leave. MailerLite also says a key stops working when the user who created it is removed from the account [5], so removing a departed contractor's MailerLite user also cuts off their keys; move any integration that depends on those keys to a new token first.
Kit is explicit that API keys are meant for your own account and that it does not officially support apps or public integrations built on API keys; some endpoints, such as bulk endpoints, require OAuth. [6] That is a useful hint about how vendors view the two methods: keys for personal scripts, OAuth for third-party tools.
Which connection type Make and Pabbly use for common apps
Make's app documentation states the credential each app connection asks for. Pabbly documents the MailerLite connection in its tutorial; for the other apps below, the connection dialog in your Pabbly account shows whether it asks for a key or opens a sign-in window.
| App | Make connection | Pabbly Connect connection | Where the credential comes from |
|---|---|---|---|
| Google Sheets | OAuth: Sign in with Google; optional custom Google client [10] | Check the connection dialog | Google consent screen |
| MailerLite | API key [11] | API key [14] | Integrations, MailerLite API, Generate new token [4] |
| Kit | API Secret from Account Settings [12] | Check the connection dialog | Kit account settings [12] |
| beehiiv | API key plus Publication ID [13] | Check the connection dialog | Settings, API, Create New API Key [13] |
| Moosend | API key [16] | Check the connection dialog | More, Settings, API key [16] |
How long access lasts
Make notes that apps using OAuth 2.0 only grant access for a limited time, and that a reauthorization can fail because tokens expired or were revoked, or permissions changed. [9] When that happens the scenario errors until someone clicks Reauthorize.
Google lists the common reasons a refresh token stops working: the user revoked access, the token was unused for six months, the user changed their password and the token includes Gmail scopes, or the Google Cloud project is in Testing status, which issues refresh tokens that expire in 7 days. [2] Make's Google Sheets page warns that a custom client in Testing status means reauthorizing every week. [10] Google also caps refresh tokens at 100 per Google account per OAuth client; creating a new one past that invalidates the oldest without warning. [2]
Kit's refresh tokens are single-use: each refresh returns a new one that must be stored. [7] That is handled by the automation tool, but it explains why a connection can break if two systems share one Kit OAuth grant.
Where to revoke access
Revoke at the source app, not only in the automation tool. Deleting a connection in Make removes Make's copy; it does not tell the app the credential is dead.
| App | How to revoke | Watch out for |
|---|---|---|
| myaccount.google.com/linkedapps, choose the app, See details, Remove access [3] | After removal the app cannot access the account and some features may stop [3] | |
| MailerLite | Tokens are created under Integrations, MailerLite API [4]; removing the user who created a key also stops it working [5] | Only the creator can see their tokens, even admins cannot [4] |
| Kit API key | Developer tab in account settings: edit the key, then Delete API Key, or Reset to issue a new value [6] | After a reset, every script using the old key stops authenticating [6] |
| Kit OAuth | The connected app calls Kit's revoke endpoint; revoking an access token also revokes its refresh token [15] | Ask the tool vendor how to disconnect if there is no button |
| beehiiv | API keys live under Settings, API [13]; OAuth apps revoke tokens with POST /oauth/revoke [8] | Delete the key used by any departed contractor's tools |
| Make API token | Profile, API access tab [17] | The full token is shown only once at creation [17] |
Least-privilege checklist
- Prefer OAuth where the app offers it, and approve only the scopes the scenario needs. [2]
- For Google, connect a dedicated account that holds only automation files, since Make's custom-client setup for Google Sheets adds the drive scope. [10]
- Create one API key per tool and purpose, named so you can find it later. [4]
- Generate keys from a company-owned user, because MailerLite binds keys to their creator. [5]
- Use MailerLite's IP allowlist for scripts on servers with fixed addresses. [4]
- Remember every member of a Make team can use and manage connections created in that team. [9]
- Twice a year, review Google's linked apps page and remove grants you no longer use. [3]
- When someone leaves, reset or delete every key they created and reauthorize OAuth connections under a company login. [6][9]
Questions before you decide
Is OAuth safer than an API key?
Usually, because OAuth grants carry scopes and durations and can be removed from your account settings. It is only as narrow as the scopes on offer: Kit's OAuth currently has a single public scope, while beehiiv offers read and write scopes per resource.
Why does my Google connection in Make keep expiring?
Google refresh tokens stop working if unused for six months, after a password change when Gmail scopes are included, or after 7 days when your own Google client is in Testing status. Make warns that Testing status means reauthorizing weekly.
Can I limit what a MailerLite API token can do?
MailerLite documents no permission scopes for API tokens. You can restrict a token to specific IP addresses, after which only requests from those addresses are accepted.
Does deleting a connection in Make revoke access?
It removes Make's copy of the credential. To kill the credential itself, revoke it in the source app, for example Google's linked apps page or Kit's Developer tab.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- IETF RFC 6749: The OAuth 2.0 Authorization Framework Accessed 30 Oct 2026
- Google for Developers: Using OAuth 2.0 to access Google APIs Accessed 30 Oct 2026
- Google Account Help: Manage connections between your Google Account and third-party apps Accessed 30 Oct 2026
- MailerLite Help: Where to find the MailerLite API key, group ID and documentation Accessed 30 Oct 2026
- MailerLite developer documentation: authentication Accessed 30 Oct 2026
- Kit developer docs: API authentication Accessed 30 Oct 2026
- Kit developer docs: OAuth refresh token flow Accessed 30 Oct 2026
- beehiiv developer docs: OAuth2 Accessed 30 Oct 2026
- Make Help: Connect an application Accessed 30 Oct 2026
- Make Apps: Google Sheets Accessed 30 Oct 2026
- Make Apps: MailerLite Accessed 30 Oct 2026
- Make Apps: Kit (ConvertKit) Accessed 30 Oct 2026
- Make Apps: beehiiv Accessed 30 Oct 2026
- Pabbly: Integrating MailerLite with Pabbly Connect Accessed 30 Oct 2026
- Kit developer docs: OAuth token revocation Accessed 30 Oct 2026
- Make Apps: Moosend Accessed 30 Oct 2026
- Make Help: API key Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.