Creating a key
At app.erp.io/settings/org/api. You need an administrator role.
Not after yourself. "Bank importer" tells the next person what breaks if they revoke it; "Dana's key" does not.
It is shown once. After that only the prefix is visible, because the key is stored hashed.
Not in the repository, not in a shared document.
curl https://app.erp.io/accounting/api/v1/accounts \ -H "Authorization: Bearer erp_live_8f2c…"
A key is not a person
API keys act for the organisation, not for the person who created them. That has three consequences worth knowing before you design around them.
- The audit trail attributes actions to the key, not to a human. Naming keys properly is what makes that legible.
- A key is not restricted by module access rules, which narrow people rather than integrations.
- A key outlives the person who created it. Removing somebody's membership does not revoke keys they made.
Keys are shared organisational secrets, not personal credentials. When somebody with access to one leaves, rotate it — create a new key, move the integration onto it, revoke the old one. Removing their membership does nothing to a key they copied into a document eighteen months ago.
Rotation
- Create a new key with the same name plus a date.
- Update the integration to use it.
- Confirm the integration is working on the new key — the last-used timestamp on the key list is how.
- Revoke the old key.
In that order. Revoking first produces an outage while somebody looks for the deployment configuration.
The key list shows when each key was last used. A key with no use for months is either a dead integration or an integration nobody knows is dead. Both are worth resolving; the second is worth resolving urgently.
What this does not do
A key acts for the organisation. There is no read-only key.
Limits are platform-set.
Keys do not expire on their own. Rotate deliberately.
A key works from anywhere.
There is no application authorisation flow.
Questions
Can we see a key again after creating it?
No. Only the prefix. Create a new one.
How many keys can we have?
Several. One per integration is the right number.
Do keys work across organisations?
No. One organisation each.