API Keys

Settings → API Keys manages the keys that grant programmatic access to the PeakCommerce Agent API (/api/v1) — the action-oriented API that external integrations and AI agents use to read and manage accounts, subscriptions, orders, payments, invoices, and webhooks on your behalf.

Why it matters

Each key authenticates a caller as your tenant. Anything a key can do is done in your tenant's data, so a leaked key is equivalent to a leaked password. Issuing separate keys per integration lets you revoke one without disrupting the others.

Create and revoke a key

1. Click Create Key and give it a recognizable name (e.g. the integration or service that will use it).

2. Copy the key value immediately — it is shown only once at creation and cannot be retrieved again afterward.

3. Pass it to the API as a credential on every request to /api/v1.

4. To retire a key, revoke it. Revocation takes effect immediately; in-flight and future requests using that key are rejected.

Security and gotchas

• Treat keys like passwords — store them in a secrets manager, never in source control, client-side code, or shared documents.

• Lost the value? You can't recover it. Create a replacement, swap it in, then revoke the old one.

• Rotate periodically and immediately on any suspected exposure.

For endpoints, request conventions, idempotency, and the webhook signature scheme these keys authenticate against, see the API reference in the Developers space. Related: Webhooks for receiving events back from PeakCommerce.