Developers & AI
Tutorial: Create and rotate an API key
Issue etsk_live_ keys for scripts, rotate safely, and revoke unused credentials.
Use API keys when you need non-interactive access (CI, scripts) without a browser OAuth dance. Keys still bind to one store.
Step 1: Open /dashboard/developer and expand an existing app (or create one first).
Step 2: Click Create API key. Copy the full etsk_live_… secret immediately — it is shown once.
Step 3: Store it in env vars (for example ETTAJER_API_KEY). Never commit it or paste it into chats.
Step 4: Test: curl -H "Authorization: Bearer etsk_live_…" https://www.ettajer.com/api/v1/context
Step 5: Confirm the JSON returns your store context. Wrong/missing key → unauthorized; wrong tenant IDs → NOT_FOUND.
Step 6 — Rotate: In the app row, Rotate on the key. Copy the new secret, update env, then discard the old value.
Step 7 — Revoke: Revoke keys you no longer use. OAuth grants can be revoked separately without deleting the app.
Step 8: Prefer OAuth for Claude/Cursor interactive use; use API keys for automation. Same scopes apply either way.
More: Developer API keys and OAuth scopes article, /developers/authentication .
Was this article helpful?
Contact support