# API keys

The **API Keys** tab under **Settings** is where you create the keys your storefront uses to consume this business's API. Keys are scoped to the currently selected business, so switch to the right business before creating one. Any signed-in team member can create and revoke keys.

For how a storefront actually uses the key (headers, scopes, errors), see [Authentication](/api/getting-started/authentication) in the API reference. The tab also links to the full **API docs** in a new tab.

## Create a key

1. Open **Settings** and switch to the **API Keys** tab.
2. In the **Create key** card, enter a **Key name** (for example `storefront`).
3. Turn on at least one scope pill. The **Create** button stays disabled until you have both a name and a scope; a hint next to it tells you which is missing.
4. Click **Create**.

### Scopes

Scopes come from your enabled modules, so the list differs per business. You always see `tenant:read`, plus a `read` and `write` scope for each module that is enabled, for example `commerce:read` and `commerce:write`. Ask the platform admin to enable a module if the scope you need is not listed.

Pick the narrowest set that works: a storefront that only shows products needs read scopes, not write.

## Copy the token — it is shown once

Right after creation, the key's plaintext token appears in a highlighted card titled **Copy this token now. Shown once.** This is the only time you can see it:

- Click **Copy token** (the label flips to **Copied** briefly) and store the token in your storefront's secret storage.
- Once you leave or refresh the page, the token can never be viewed again.
- If you lose it, there is no recovery: revoke the key and create a new one.

## Review your keys

Each key card shows the name, its scope list, when it was created, and **Last used** with a date, or **Never used** if nothing has called the API with it yet. **Never used** on an old key is a good signal it can be revoked.

## Revoke a key

1. Click **Revoke** on the key's card.
2. A **Revoke key** dialog confirms: storefronts using this key lose API access immediately.
3. Click **Revoke** to confirm.

Revoking is instant and permanent. If a live storefront still uses the key, create a replacement key first, deploy it, then revoke the old one.