# 🔑 How to Rotate or Revoke a Data API Key

> Create, regenerate and revoke keys yourself on the API Keys page.

*Published: 2026-10-12 | Updated: 2026-10-12 | Source: https://shopsavvy.com/help/how-to-rotate-or-revoke-a-data-api-key*

---

Manage keys at [shopsavvy.com/data/api-keys](https://shopsavvy.com/data/api-keys).

## Rotate a key

1. Open **API Keys** and choose **Regenerate** on the key.
2. Copy the new secret right away. Keys are stored as hashes, so we cannot show a secret again later.
3. Deploy the new key. The old secret stops working when you regenerate, so update your systems first if you cannot afford a gap, by creating a second key, switching to it, then revoking the first.

## Revoke a key

Choose **Revoke** on the key. Requests with a revoked key return HTTP 401 `ERR_AUTH_REVOKED`.

## Never seen your key?

If your account created a key you have never seen and it has never been used, **Show key** gives that key a fresh secret and shows it once. A key that has been used must be regenerated instead.

## Good practice

- Keep keys in environment variables or a secrets manager, never in client-side code or a public repository.
- Use one key per environment or service, so you can revoke one without touching the others.
- Keys look like `ss_live_` followed by 32 characters; anything else returns `ERR_AUTH_INVALID`.

More on security: [shopsavvy.com/security](https://shopsavvy.com/security).

---