borkoldocs

Workspace

API keys

Create scoped storefront API keys, copy the one-time token, and revoke keys you no longer use.

View as Markdown

The API Keys tab under Settings is where you create the keys your storefront uses to consume this business's API. Keys are scoped to the currently selected business, so switch to the right business before creating one. Any signed-in team member can create and revoke keys.

For how a storefront actually uses the key (headers, scopes, errors), see Authentication in the API reference. The tab also links to the full API docs in a new tab.

Create a key

  1. Open Settings and switch to the API Keys tab.
  2. In the Create key card, enter a Key name (for example storefront).
  3. Turn on at least one scope pill. The Create button stays disabled until you have both a name and a scope; a hint next to it tells you which is missing.
  4. Click Create.

Scopes

Scopes come from your enabled modules, so the list differs per business. You always see tenant:read, plus a read and write scope for each module that is enabled, for example commerce:read and commerce:write. Ask the platform admin to enable a module if the scope you need is not listed.

Pick the narrowest set that works: a storefront that only shows products needs read scopes, not write.

Copy the token — it is shown once

Right after creation, the key's plaintext token appears in a highlighted card titled Copy this token now. Shown once. This is the only time you can see it:

  • Click Copy token (the label flips to Copied briefly) and store the token in your storefront's secret storage.
  • Once you leave or refresh the page, the token can never be viewed again.
  • If you lose it, there is no recovery: revoke the key and create a new one.

Review your keys

Each key card shows the name, its scope list, when it was created, and Last used with a date, or Never used if nothing has called the API with it yet. Never used on an old key is a good signal it can be revoked.

Revoke a key

  1. Click Revoke on the key's card.
  2. A Revoke key dialog confirms: storefronts using this key lose API access immediately.
  3. Click Revoke to confirm.

Revoking is instant and permanent. If a live storefront still uses the key, create a replacement key first, deploy it, then revoke the old one.