Developer API keys let trusted software act on behalf of your workspace. They are intended for developers and should be protected like passwords.
Before you create a key
Only the workspace owner can open API Keys, create keys, or revoke them. Workspace administrators cannot manage them.
Your workspace plan must include Developer API keys. If it does not, the page explains that the current plan does not include this capability. The platform also applies the active-key limit defined by the current plan; revoking an unused key frees capacity for a replacement.
Only create a key for software you control and understand.
Create a key
- Open API Keys from the workspace menu.
- Choose Create API key.
- Give the key a clear name that identifies the system using it.
- Copy the secret immediately and store it in a secure password or secrets manager.
The key is delivered as a protected download and the full secret is available only once. Zendrhax keeps only what it needs to verify future requests, so a lost key must be revoked and replaced.
Use the key
Send the secret in the authorization header of an API request:
~~~http GET /api/invoices Authorization: Bearer sk_example_only_not_a_real_secret ~~~
Never place a key in a public webpage, mobile app bundle, screenshot, support message, or source-control repository.
Each key is limited to the workspace where it was created. It cannot read or change information from another workspace.
If a request is rejected
- Confirm that the key is active and belongs to the correct workspace.
- Confirm that the workspace plan includes access to the requested API operation.
- Check the request address and required permissions in the developer documentation.
- Slow down automated requests if the service reports too many attempts.
Revoke a key
Revoke a key immediately if it was shared accidentally, stored insecurely, or is no longer used. Software still using it will lose access immediately. Create a replacement only after removing the exposed key from the affected system.
Use one key per integration and rotate it when a person or system that had access should no longer use it. This lets you revoke one integration without interrupting the others.
Important separation
A Zendrhax API key is not a Stripe key and does not grant direct access to a connected Stripe account.