🔑 How to Rotate or Revoke a Data API Key

Manage keys at shopsavvy.com/data/api-keys.

Rotate a key

1. Open API Keys and choose Regenerate on the key.
2. Copy the new secret right away. Keys are stored as hashes, so we cannot show a secret again later.
3. Deploy the new key. The old secret stops working when you regenerate, so update your systems first if you cannot afford a gap, by creating a second key, switching to it, then revoking the first.

Revoke a key

Choose Revoke on the key. Requests with a revoked key return HTTP 401 ERR_AUTH_REVOKED.

Never seen your key?

If your account created a key you have never seen and it has never been used, Show key gives that key a fresh secret and shows it once. A key that has been used must be regenerated instead.

Good practice

• Keep keys in environment variables or a secrets manager, never in client-side code or a public repository.
• Use one key per environment or service, so you can revoke one without touching the others.
• Keys look like ss_live_ followed by 32 characters; anything else returns ERR_AUTH_INVALID.

More on security: shopsavvy.com/security.