Authentication and API keys

Issue keys under Developer → API Keys in the console. Only administrators with the permission to issue keys can do this.

The key is shown once, when it is issued. Store it somewhere safe. We do not keep the key itself — only a value used to check it.

• Scope — narrow the key to the permissions you pick, or give it the owner's full range. We recommend granting only what is needed.
• Brands — choose which brands the key may touch.
• Expiry — from 1 day to 10 years. An expired key stops working.
• A key can never be given a permission its owner does not have.

Send the key in the request header:

• Authorization: Bearer <API key>

You do not name a company. Which company the key belongs to is decided from the key itself.

Revoke a key you no longer use, or one that may have leaked, on the same screen. A revoked key stops working at once. If a key may have leaked, also tell our security contact.