The API key and the API secret work together, like a user name and a password: the key says who is calling, the secret proves it.

Generate your keys

  1. In the menu, under Configuration, click Settings.

  2. In the Marketplace group, click the Account & team card. The Account screen opens.

  3. In the API access section, click Generate secret key. The confirmation message “API credentials successfully created.” appears.

  4. The section now shows two fields:

    • API key: it starts with pk_;
    • API secret: it starts with sk_.

    Click a field to select its value, then copy it.

Send both values to your developer through a channel that keeps them private (a password manager, for instance), never in a plain email or a shared document.

Replace your keys

Replace them when they may have leaked, when someone who knew them leaves the project, or to cut off an old integration:

  1. Open Settings › Account & team.
  2. In the API access section, click Generate a new key.

A new key and a new secret are created, and the previous pair stops working at once: there is no confirmation dialog. Update every tool that used the old pair straight away.

There is no button to disable the keys: generating a new pair is how you cut off access.

Give an integration its own keys

The keys belong to the administrator who generated them, and only that administrator sees them on the screen. If that administrator generates new keys, every tool using their pair stops.

For a lasting integration (an ERP, an accounting tool), create an administrator dedicated to it, for instance integration@your-company.com: in the Accounts and permissions section of the same screen, click Add staff account (only the account owner sees this button). Once the invitation is accepted, that administrator generates the keys, and the integration no longer depends on one person.

What your users see

Nothing: the keys exist only in the admin panel and in the tools you give them to.

Edge cases and limits

  • No limited keys: a pair has every right of an administrator, on the whole marketplace. There is no read-only key and no key restricted to some data.
  • The email address as a key: older integrations send the administrator’s email address instead of the pk_ key, with the same secret. It still works; use the pk_ key for anything new. An administrator whose secret dates from before the pk_ keys sees their email address in the API key field: Generate a new key gives them a pk_ key, and cuts off the old pair.
  • Partners API: a seller’s access to the Partners API is not generated on this screen. It is issued on request: contact Kreezalid support with your marketplace and the seller’s account.
  • Front API: there is no key for it; a user signs in with their own email and password.