> ## Documentation Index
> Fetch the complete documentation index at: https://andcze.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, scope, and revoke shop and plugin keys.

<Frame caption="API-key list in the shop dashboard">
  <img src="https://mintcdn.com/andcze/6Qp9zwUm8VUzRssf/images/panel/api-keys.png?fit=max&auto=format&n=6Qp9zwUm8VUzRssf&q=85&s=5bd2c96ae3af0d2cc9df2467446d0cb8" alt="API-key table with type, scope, and last use" width="1280" height="720" data-path="images/panel/api-keys.png" />
</Frame>

An API key is a secret for a program, not a person. You create it inside one shop and decide which resources it may access.

## Two key types

<Columns cols={2}>
  <Card title="Plugin" icon="plug">
    Reserved for the official real-time fulfillment protocol. The default and recommended scope is only `orders:write`.
  </Card>

  <Card title="Store (integration)" icon="store">
    REST calls for one shop. Grant only the scope needed by the report, dashboard, or automation.
  </Card>
</Columns>

Account-wide keys are not offered. Account operations, shop creation, and owner-only actions require a dashboard session.

## Create a key

<Steps>
  <Step title="Choose a preset">
    **Minecraft plugin** selects `orders:write`. **Store integration** proposes a read-only scope. Use **Full access** only for your own trusted system.
  </Step>

  <Step title="Set a name and type">
    Identify the service and environment, for example “Reports production”. Do not use a Plugin key as a general REST key.
  </Step>

  <Step title="Restrict permissions">
    Select the resource and action. `write` includes `read`; `manage` includes `read`, `write`, and `delete`.
  </Step>

  <Step title="Set an expiry">
    Pick a date for temporary integrations. Dates in the past are rejected.
  </Step>

  <Step title="Copy the secret">
    The full key is shown once. Store it in a secret manager, never in a repository or a file sent to users.
  </Step>
</Steps>

## Permissions

The catalog covers **Shop, Products, Servers, Orders, Payments, Payment methods, Discount codes, Vouchers, Statistics, API Keys, and Team**. The dashboard reads the current list from `GET /api/v2/api-keys/permissions`.

<Warning>
  A team member can create or expand a key only within their own scope. A `shop` key is also compared with `{shopId}` in the URL. Using it for another shop returns `403`.
</Warning>

## Use

```http theme={null}
X-API-Key: isk_...
```

Look for `apiKeyAuth` on an endpoint in the API reference. Not every Bearer endpoint accepts a key. A Plugin key connects over Socket.IO as described in the plugin guide; it does not use the retired REST polling flow.

## Edit and revoke

The list shows the name, type, shortened preview, scope, creation, last use, expiry, and status. You can rename a key or reduce its scope. If the secret is lost, revoke the key and create another one; the full secret cannot be recovered.

Revoke a key immediately when:

* it appears in logs, chat, a support ticket, or a public repository;
* the service is decommissioned;
* you do not recognize its last use;
* the integration or server changes hands.