Your API key authenticates every request your integration makes. This page covers creating one, using it, and replacing it if it leaks.
Before you create one
A key belongs to the employee account that created it, and it inherits that account's access. Two things follow:
- Create a dedicated employee account for each integration rather than issuing keys from a person's login. When someone leaves, you disable their account without taking your integration down with it.
- Deleting an employee account invalidates its keys. If an integration stops authenticating, check that its account still exists before you debug anything else.
You can hold more than one key at a time, which is what makes rotation possible without downtime.
Creating the key
Sign in to the Wallet Administrative Portal and go to Settings » My Profile » My Account » My API Keys:
Give the key a title and a description:
Both are for you, not for us. In six months the description is the only thing telling you which service holds this key and whether it is safe to revoke. "Nightly inventory sync, staging" beats "test key."
Click Create.
Save it immediately
You will be prompted to save the key somewhere safe:
The key is shown once and is never retrievable again. Copy it into your secret store before you close that window. If you lose it, you cannot recover it; you create a replacement and revoke the old one.
The key in the screenshot above was permanently deleted, which is why it can be shown here.
Treat a live key like a password:
- Store it in a secrets manager or an environment variable, never in source control.
- Never paste it into a support ticket, a screenshot, or a browser console.
- Give each integration its own key, so revoking one never takes down the others.
Using the key
Send it in the access-token request header:
curl https://api.wall.et/v2/dashboard/count/visitors \
-H "access-token: YOUR_API_KEY"A 401 means the key is missing, malformed, or revoked. See Using Postman for setting the header in an HTTP client, or apply your key directly to the API Reference pages here in the Developer Hub to try endpoints in the browser.
Rate limits are counted per key, so each integration gets its own budget rather than competing with the others.
If a key leaks
Create a new key, move your integration onto it, then delete the old one from the same My API Keys panel. Because you can hold several keys at once, you can do this in that order and never take an outage. Do not wait for a convenient window: a leaked key is live until it is deleted.
Getting help
Email [email protected].