> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Make a secret key for your own server, say what it may do, and see what it did

A secret API key lets your own server do what the dashboard does: read orders, add stock, refund, and the rest. Keys are under **Developers**, then **API Keys**.

## Making one

Press **Add API Key** and give it:

* **A name**, after what will use it: "Order sync", "Discord bot".
* **Permissions**: what it may do. Start from **Read Only**, **Orders and Stock** or **Everything**, or pick your own, then open a group to tick or untick one. Give it only what that job needs. Every permission is listed on the [permissions page](/api-reference/permissions.md).
* **Allowed Addresses**, if you want: the IP addresses or ranges it may be used from. A key that leaks is then no use to whoever found it.
* **Allowed Domains**, if you want: the same thing by name. A domain such as `server.example.com` stands for the address it points at, so the key goes on working when your server moves and its DNS record follows. It has to point straight at the server: a domain behind Cloudflare points at Cloudflare, and is refused when you type it.
* **A last day**, if you want: a date it stops working by itself.

The key starts `shoply_sk_` and is shown once. Keep it somewhere safe. A store holds up to 15 keys.

Signing in to the [Shoply CLI](/guides/cli.md) makes a key too, named after your computer, with the two storefront permissions and nothing else. It counts toward the 15, and is changed or revoked here like any other.

An app you connect to your store is not on this page. It works with a token of its own, until you disconnect it under **Developers**, **OAuth Apps**, **Connected**. See [Apps and OAuth](/guides/oauth.md).

## Changing and replacing one

A key's name, permissions, addresses and domains can be changed. Its secret cannot be read again, though it can be **replaced**: the old secret stops working at once and the key keeps everything else. **Revoke** ends a key for good.

You are asked to confirm it is you before a key is made, widened or replaced, and the store's owner is told by email.

## What a key did

**Activity**, under **Developers**, lists every request made with your store's keys for the last 30 days: when, which key, what was asked, what the answer was, and how long it took. Open one to see what was sent and what came back.

A request that was refused is listed too, with why. That includes a key being tried from an address it does not accept, which is how you find out that one has got loose.

What is never kept: the key itself, passwords and secrets in a body, and license keys on their way into stock.

## Next

> **[From a key to an answer](/api-reference/quickstart.md)**
>
> A new key, its store, and your products read back.

> **[Authentication](/api-reference/authentication.md)**
>
> How a key is sent and what protects it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.