Authentication
Creating an API key, sending it, and what it can reach.
Every request carries an organization API key. There's no OAuth flow and no user login: the key is the credential.
Getting a key
Open Developers
In the dashboard, Developers — it's in the left menu, above Settings. It's Owner and Admin only.
Create the key
Give it a name that says where it will run ("Website", "Backoffice sync"). You'll use that name later to revoke exactly the right one.
Pick an expiry
No expiry, or 30, 90, 180 days or a year. A key that expires is the cheap version of rotation: pick a date if the integration is something you'll be around to renew.
Copy it now
The key is shown once. We store a hash, not the key, so if you lose it there's nothing to recover — you create a new one and revoke the old.
An API key is a full credential over your organization's data. Keep it on a server, in an environment variable or a secrets manager. Never in front-end code, in a repository, or in a browser: anything that ships to a visitor ships the key with it.
Sending it
Two headers work, and they're equivalent. Pick one.
Missing or invalid, you get a 401:
{ "error": { "code": "API_KEY_MISSING", "message": "The API key is missing or not valid." } }What a key reaches
One organization, all of it. The key is bound to the organization it was created in, and no request ever names an organization — everything you read and everything you write stays inside that one. If you run several, create one key per organization.
There is no per-key scoping and no read-only key today. Every key can do everything the API can do, which today means: read across the operation, and write customers and catalogue products.
A key is not a person. It carries no role and it isn't affected by the agency's policies: those limit what a member sees in the dashboard, and a key isn't a member. What a key reads is the whole organization.
Revoking
From the same Developers screen. Revoking takes effect immediately, and it's the right move any time a key might have been exposed — there's no rotation window to wait for and nothing else breaks, because keys are independent of each other.
That's also why the name matters: with one key per integration you revoke the one that leaked instead of taking down everything at once.
Watching how it's used
Developers → Activity shows the requests your keys make: which endpoints, what status they came back with, how long they took. It's the fastest way to tell "my integration is broken" apart from "my integration isn't calling".