API keys
Create, scope, rotate and revoke the API keys your integration uses, from Dashboard → API keys.
Your integration calls Tanitar with an API key. Dashboard → API keys is where an administrator creates those keys, decides what each one may do, and replaces or retires them. For how a key is used on a request, see API keys and scopes.
Each key on the page shows its name, state, display prefix (the first characters of the key, so you can tell keys apart), revision, scopes, expiry and when it was last rotated. The secret itself is never shown again after the moment it is created.
Create a key
- Select Create key.
- Enter a Key name that says what the key is for, for example
tournament-backend-prod. - Under Effective scopes, tick only the scopes this integration needs. The list offers the scopes your plan and entitlements grant you, and nothing else. Select at least one.
- Optionally set an Expiry date. Without one, the key does not expire.
- Select Create key.
- The Save this key now dialog shows the key in plain text. Copy it into your secret store, then select I saved it.
The key is shown once. It cannot be recovered after the dialog closes, by you or by Tanitar. If you lose it, rotate the key or create a new one.
Give each integration or environment its own key with the smallest scope set that works. A key with
shop:read only cannot change your catalog even if it leaks.
Reduce a key's access
Select Edit on an active key to open Reduce key access. You can rename the key and untick scopes. The dashboard can only take scopes away: scopes the key does not already hold are disabled. To give an integration more access, create a new key with the scopes it needs and retire the old one.
Rotate a key
Rotation replaces the key's secret while keeping its name and scopes.
- Open the actions menu on the key and select Rotate.
- Confirm in Rotate key secret.
- Save the new secret from the Save this key now dialog.
The old secret stops working as soon as the new one is issued; there is no overlap window. To replace a key without interrupting traffic, create a second key with the same scopes, deploy it, and then revoke the first.
Revoke a key
- Open the actions menu on the key and select Revoke.
- Confirm in Permanently revoke key.
The key stops authenticating immediately. Revocation cannot be undone.
What can go wrong
| What you see | Why | What to do |
|---|---|---|
| Active-key quota reached and Create key is disabled | Your plan caps the number of active keys | Revoke a key you no longer use, or ask Tanitar to change your plan |
| A scope you expected is not offered | Your plan or entitlements do not grant it | See Dashboard → Access for your effective entitlements |
SCOPE_CEILING_EXCEEDED | A scope was removed from your entitlements while you were editing | Reload the page and choose again |
REVISION_CONFLICT | Someone else changed or revoked the key since you loaded the page | Reload the page and retry |
| Members have read-only API-key access. | Your role is org:member | Ask an admin; see Signing in |