---
title: "API keys"
description: "Create, scope, revoke and delete the publishable API keys of your storefronts."
url: "https://docs.poltura.com/en/developer/api-keys/"
lang: en
alternates:
  en: "https://docs.poltura.com/en/developer/api-keys/"
  hu: "https://docs.poltura.com/hu/developer/api-keys/"
---

# API keys

Create, scope, revoke and delete the publishable API keys of your storefronts.

- Where: Settings → Developer → Publishable API Keys
- Status: Developer mode

This page appears only when [developer mode](https://docs.poltura.com/en/developer/) is switched on.

A **publishable** API key identifies a storefront. It is public: it may sit in the code of a website. It decides which [sales channels](https://docs.poltura.com/en/developer/sales-channels/) that storefront can see. The keys are listed in **Settings → Developer → Publishable API Keys**.

You need this page when you build your own storefront. To connect a back-office system to your store, use an API token instead. Create a personal one in Poltura ID under **Account → API tokens**, or an organization one under **Settings → Organization → API & access**. A token holds only the permissions and stores you choose.

![The Publishable API keys list with one active key, its masked token and the date it was created, and the Create button](https://docs.poltura.com/screenshots/en/developer/api-keys.webp)

_Only the start and end of each token are shown in the list._

## Before you start

You need a role that includes store settings, such as Owner, Administrator or Store manager.

## Create a publishable key

1. Open **Settings** and choose **Publishable API Keys** in the **Developer** group.
2. Select **Create**.
3. Type a **Title** that says what the key is for, then save.
4. The page of the new key opens with the status **Active**. The **Token** row shows the whole key with a copy button and the note **Public, safe in a storefront**.
5. In the **Sales Channels** section select **Edit sales channels**.
6. Tick the channels this key may reach and save.
7. The section now lists the channels. A storefront that sends this key sees the products of these channels only.

You can open the page again at any time to copy the token. A publishable token is not hidden after creation.

> **Warning**
>
> A publishable key with no sales channel does not work: product requests made with it are refused. Link at least one channel before you use the key.

## Rename a key

1. Open the key from its list.
2. Select **Edit API key**.
3. Change the **Title** and save.

Renaming does not change the token, the linked channels or the status.

## Revoke a key

Revoke a key when it leaked or when the integration that used it is retired.

> **Warning**
>
> Everything that still uses the key stops working at once. A revoked key cannot be restored.

1. Open the key from its list.
2. In the **Revoke API key** section at the bottom select **Revoke API key**.
3. Type the title of the key to confirm, exactly as it is written.
4. Select **Revoke API key**.
5. The key now shows the status **Revoked**, and the **Details** section shows **Revoked at** and **Revoked by**.

To replace a key without an outage, create a second key first, link the same sales channels, switch your storefront to it, and only then revoke the old key. Several active keys can exist side by side.

## Delete a key

Only a revoked key can be deleted. Deleting removes it from the list for good.

1. Open a revoked key.
2. In the **Delete this API key** section select **Delete API key**.
3. Type the title of the key and confirm.
4. You return to the list and the key is gone.

## Good to know

- Each list shows **Title**, **Token** (shortened), **Status**, **Last Used At** and **Created**. You can search by title and filter by created, updated or revoked date.
- **Last Used At** stays empty for now. Do not use it to decide whether a key is still in use.
- **Created by** and **Revoked by** show a technical identifier, not a person's name.
- Two keys may have the same title. Give every key its own title, because revoking and deleting ask you to type it.
- A title can be up to 200 characters long.
- A publishable key never gives admin access.

## If something goes wrong

- **"An API key has to be revoked before it can be deleted."** Revoke the key first.
- **"That does not match, so nothing was changed."** The title you typed differs from the key's current title. Check capital letters, and check whether someone renamed the key.
- **"That API key could not be found".** The key was deleted or belongs to another store.
- **A storefront stopped loading products.** Its key was revoked or has no sales channel linked.

## Related

- [Developer mode](https://docs.poltura.com/en/developer/)
- [Sales channels](https://docs.poltura.com/en/developer/sales-channels/)
- [Your own apps](https://docs.poltura.com/en/developer/apps/)
- [People and roles](https://docs.poltura.com/en/settings/organization/team/#roles)