Skip to main content
Every reseller request carries one header:
A partner key is scoped to you, not to one business. It can reach every tenant in your workspace and nothing outside it.

​
Getting a key

Keys are minted from the reseller console, under API keys. They cannot be minted with an API key.
That restriction is deliberate. A key that can mint keys survives its own revocation: whoever held a leaked token would issue themselves a replacement before you noticed, and could revoke your real keys on the way out. Minting is a signed-in, human act.
The secret is shown once, at creation. We store a hash and cannot recover it. If you lose it, revoke it and mint another.

​
Never send it from a browser

The API rejects any partner key that arrives with an Origin header, because a browser is the one client that always sends one. Keep it in your backend’s secret store.

​
Scopes

A key only reaches what it was granted. Grant the minimum a caller needs — then a leaked key is a smaller problem. messages:* is deliberately separate from assistants:write: a key issued to edit a prompt should not thereby be able to message a merchant’s customers. Likewise webhooks:manage from webhooks:read — creating an endpoint and rotating its signing secret is a different authority from reading what was delivered, and the secret is the thing an attacker wants. A request outside a key’s scopes returns 403 with the missing scope named:

​
Expiry and rotation

A key can carry an expiry, and is otherwise valid until revoked. To rotate without downtime: mint the new key, deploy it, confirm traffic has moved (the console shows last used per key), then revoke the old one.