API clients
One key per integration,
with only the access it needs
Your integrations no longer share one all-powerful organization key. Create a named API client for each one, give it the same permission groups your people have, and rotate or revoke it on its own.
Hi there,
Until now, every organization had a single API key. Your ERP, your order import and your reporting tool all used the same key, and it could do everything an integration can. If one partner needed a new key, everyone did. API clients fix that.
Give each integration its own client and key, for example “ERP” or “Warehouse sync”. You see when each one was last used.
A client gets permission groups, just like a person. A reporting tool can read orders without being able to change them, or see orders without their prices.
And nothing breaks on release. Your existing organization key keeps working exactly as before. You move integrations over one at a time.
Access
Choose what each client may do
Every client starts from a preset. Adjust single groups, such as Orders or Order prices, and the client becomes Custom.
A client never reaches more than the old organization key could, and it can never manage users, access or other API clients. A client without Order prices gets orders with the prices left out.
For admins
Setting it up
Everything lives under Settings → Developer → API clients. Only people with the Admin preset can manage clients, and an organization can have up to 25.
Create a client
Click New client, name it after the integration and pick its access.
Copy the key
The key is shown once. Copy it straight into the integration or your password manager. Zendera only keeps a fingerprint of it, so it can't be shown again.
Switch the integration
Replace the old organization key with the new one. It goes in the same header as before, so nothing else changes for the developer.
Rotate or revoke when needed
Rotate gives the client a new key and stops the old one at once. Revoke switches the client off. Other clients are not affected.
It keeps working, and it appears in the list as Legacy key (full access). You can still reveal or delete it, but it can no longer be created or regenerated. When none of your integrations use it any more, delete it.
A refused request now says why: a 403 names the group and level the client is missing. The authentication guide has the key format, the error responses and a quick test call.
Give each integration its own key
Start with one integration. Create its client, switch the key, and check that Last used updates.