Skip to content
ITEMRA
Documentation menu

Integrations

API keys

Scoped keys for the public API: live vs dev environments, one-time secrets, rotation, IP allowlists, and usage.

Keys and scopes

Settings → API keys manages access to the public API. Every key carries a label and an explicit scope set — items:read, stock:write, reports:read, and so on — and can do nothing outside it. Grant the narrowest set the integration needs; separate keys per integration keep blast radius and usage attribution clean.

Keys with environment, fingerprint, security, and scopes.

Live vs dev

A key targets an environment: live works against your real data; dev keys operate against an isolated sandbox dataset, so integration development can create and destroy freely without touching production inventory. (Sandbox availability follows the plan.)

Create, reveal once, rotate

Creating a key picks label, environment, scopes, optional expiry, and security settings.

Scopes are chosen at creation — narrow by default.

The secret is shown once, at creation — store it in your secret manager immediately; afterwards only a fingerprint and the last characters remain visible. Rotate issues a new secret with a configurable overlap window during which the old secret still works — zero-downtime rotation. Revoke ends a key immediately.

Security settings and usage

Per key: an IP allowlist (up to 64 addresses or CIDR ranges) and an optional rate-limit override. The usage view shows request volume per key — the baseline that makes anomalies visible, and the input for quota planning. Every security change is audited.