⚙️ API Keys
Create and manage API keys that allow external systems (e-commerce platforms, third-party apps) to access your LKG for Billing product catalog and data.
Navigate to Administration → API Keys (within Settings).
API key management requires External API Access to be enabled in Settings.
Overview
API keys are credentials that authorise external applications to call your business's API endpoints. Each key can be scoped to test or live mode, rate-limited, and restricted to specific origins.
Table Columns
| Column | Description |
|---|---|
| Name | Display name for the key |
| Mode | Test or Live |
| Key | Masked key — shows last 4 characters only (e.g., ••••••••abcd) |
| Rate Limit | Maximum API requests per minute |
| Allowed Origins | Domains permitted to use this key |
| Status | Active or Inactive |
| Expiry | Key expiry date (if set) |
| Actions | Copy, regenerate, toggle active, revoke |
Creating an API Key
- Click + New API Key
- Fill in:
| Field | Required | Description |
|---|---|---|
| Name | Yes | Descriptive label (e.g., "Shopify Integration") |
| Mode | Yes | Test (sandbox) or Live (production) |
| Rate Limit | No | Max requests per minute (leave blank for no limit) |
| Allowed Origins | No | Comma-separated domains allowed to use this key (e.g., shop.example.com) |
| Description | No | Notes about what this key is used for |
- Click Save
- The full key is displayed once — copy it immediately
The full API key is shown only once at creation. If you lose it, you must regenerate the key (which immediately revokes the old one).
Copying a Key
Click the Copy icon on a row to copy the masked key. To get the full key again, use Regenerate.
Regenerating a Key
- Click Regenerate on the key row
- Confirm — the old key is immediately revoked
- The new full key is displayed once — copy it immediately
Toggling Active / Inactive
Click the Active toggle to enable or disable a key without deleting it. Inactive keys are rejected by the API.
Revoking a Key
Click Revoke to permanently delete a key. This cannot be undone. Any integration using the revoked key will immediately lose access.
Security Best Practices
- Use separate keys for test and production environments
- Restrict Allowed Origins to only the domains that need access
- Set Rate Limits to prevent abuse
- Rotate keys periodically using Regenerate
- Revoke keys that are no longer in use