API Keys
Create and manage API keys for programmatic access to your farm data
adminAPI Keys
The API Keys page lets you create long-lived credentials for integrating external systems with Sporeline. It lives at Settings > API Keys.
Role requirements
Managers and Owners (and SuperAdmin) can view, create and revoke API keys. A Manager can revoke any key on the account, including one an Owner made.
How API keys work
API keys authenticate programmatic requests to the Sporeline REST API. Include the key in every request using the Authorization header:
Authorization: ApiKey <your-key>
API keys are scoped to your tenant and carry the same data access as any other authenticated call. They are not associated with a specific user — key-authenticated requests run with the Manager role. A key can’t change settings, set up integrations or manage API keys; those need a person signed in to Sporeline. See Authentication.
Creating a key
You can have up to 10 active keys at a time.
- Click Create Key in the top right.
- Enter a Key Name — a descriptive label to identify what this key is used for (e.g.
Production Integration,ERP Sync). - Optionally set an Expiration Date. Leave blank for a key that never expires.
- Click Create Key.
Important: The full API key is displayed once immediately after creation. Copy it and store it somewhere secure — it will not be shown again. Only a short prefix is stored for identification purposes.
Key table columns
| Column | Description |
|---|---|
| Name | The descriptive label you gave the key |
| Key | The stored prefix of the key (e.g. mt_live_AbCdEfGh...) |
| Status | Active, Expired, or Revoked |
| Expires | Expiration date, or “Never” |
| Created | Date the key was created |
| Last Used | Date the key was last used in a request, or “Never” |
Revoking a key
Click the trash icon on any active key row. A confirmation dialog explains that any integrations using the key will lose access. Click Revoke Key to confirm. Requests using the key stop working within five minutes.
Revoked keys cannot be re-activated. If you need to restore access, create a new key.
Security best practices
- Give each integration its own key so you can revoke one without affecting others.
- Set expiration dates for keys used in temporary or short-lived integrations.
- Rotate keys periodically by creating a new key, updating your integration, then revoking the old one.
- Never commit API keys to version control.