Where do I get my API key?

Under API keys in your seller dashboard. Create one, and the secret is shown once.

Shown once, deliberately

We store a hash, not the secret, so we genuinely cannot show it to you again later. Copy it into your password manager or your deployment config at the moment you create it. If you lose it, you create a new key, which takes seconds.

Use more than one

Keys are free, so give each item its own, and give staging its own separate from production. When something needs to be revoked you then revoke exactly one thing, instead of taking down everything you sell at once.

Revoking

Revoke from the same page, and it takes effect immediately. Do it the moment you suspect a key has leaked: pushed to a public repo, pasted into a support thread, or sitting in a zip you shipped by mistake.

Revoking stops that key working, so deploy the replacement first if the key is live in an item your buyers are running.

Keeping it safe

• Environment variable or a config file outside the web root.
• Never in client-side JavaScript, never in a mobile app binary.
• Never committed to version control, and never inside the zip you distribute.
• Rotate it if a contractor with access moves on.

The key identifies you, not your buyer. Whoever holds it can make licence checks as you.