Create, rotate and revoke API keys

Kort fortalt

You manage your keys in the API keys panel on the developer dashboard. Every key is shown once, when you create or rotate it, so copy it straight away.

Test and live keys

- Test keys start with pk_test_. They read real data and check bookings fully, but never store a booking or email anyone. - Live keys start with pk_live_. They need a paid plan that is paid up, and two-factor sign-in on your account. Turn it on in Settings, Security.

Create a key

1. Under Key name, give it a name you will recognise, for example the app that uses it. 2. Pick the Mode: Test or Live. 3. Choose Create key and copy it.

You can have up to 10 active keys. Revoke one you no longer use to make room.

Send the key

Put the key in the Authorization header of every call:

Authorization: Bearer pk_live_...

Without it you get 401 missing_key. A key that is wrong or incomplete gets 401 invalid_key. Keep keys on your server, never in code that runs in a browser or app where people can read it.

Rotate a key

Choose Rotate next to the key and confirm. You get a new key with the same name and mode, and the old one stops working straight away. Rotating a live key also needs two-factor sign-in and a paid up plan.

Revoke a key

Choose Revoke and confirm. Anything using it stops working straight away; calls get 401 key_revoked. You cannot undo this, but you can create a new key.

If a key leaks

Rotate or revoke it at once. Anyone with your key can use your allowance. Each key in the list shows how many requests it has made and when it was last used, which helps you spot one you did not expect.