API keys and webhooks

API keys let your own code read and manage the account, its orders, proxies and usage, instead of the dashboard. Webhooks post events to an endpoint you run, so you do not have to poll. Both are under Tools in the sidebar.

Generate an API key

1. Confirm your email address first; a key cannot be generated on an unconfirmed account.
2. Open Tools > API keys and select Generate new key.
3. Copy the API key and API secret into your secrets manager.

Generate one pair per integration. Keys carry no name or scope, so separate pairs are how you retire one integration without disturbing the others. Treat the secret like a password.

Try a call before writing code

Tools > API playground builds a request against your own account, sends it, shows the response and lets you copy the request as a cURL command. The playground signs requests with your dashboard session. From your own code, send the key and secret in the X-Api-Key and X-Api-Secret headers.

Rotate or delete a key

1. Generate the new pair and deploy it.
2. Back on API keys, select Delete on the old pair and confirm Delete key.

Deletion is immediate and cannot be undone. Anything still using the old key stops working.

Webhooks

1. Open Tools > Webhooks and select Add webhook with the URL of an endpoint that accepts JSON POST requests.
2. Store the signing secret shown to you and verify the signature on every delivery before trusting it.
3. Use Send test event to check your endpoint.

Each webhook keeps a Deliveries log of what was sent, what your endpoint answered and how many attempts it took, with Retry this delivery on each attempt. Rotate secret issues a new signing secret and shows it once; the old secret stops verifying immediately, so deploy the new one at once.

Related

• Securing your account