Last updated: Sep 19, 2026 at 11:56PM
An API key lets a program act on your Osello account without signing in as you — a script that syncs your catalog, an integration your developer built, or an AI coding agent working against your data.
Create a key
- Open Manage Account from the menu under your name, then the API keys tab.
- Click Create key.
- Give it a name you will recognize later, like "Nightly inventory script" or "Local coding agent".
- Choose what it can reach (see below). Give it the least it needs.
- Click Create key.
The key is shown once, on the screen that appears. Copy it before closing — Osello stores only a fingerprint of it, so nobody, including our support team, can look it up again. If you lose it, revoke the key and create another.
What a key can reach
Each key is granted one level per kind of data — No access, Read only, or Write:
- Source data — products, variants, images, inventory, imports, exports and your store settings.
- Channel listings data — listings, field values, channels, offers and submissions.
- Orders & customer data — marketplace orders, returns, and the customer details collected to fulfill them.
- Store settings — who has access to the store, your subscription and invoices.
The first three build on each other, so each one appears only once the one above it is readable. A key that can't see your products can't see the listings made from them, and a key that can't see your listings can't see the orders they produced. For the same reason, a category can't be set higher than the one it depends on: to write listings, a key needs to write products too.
A key can never do more than the person it belongs to. Remove someone from a store and their keys lose that store with them.
Redact PII data. When a key has read-only access to orders, a checkbox appears inside that section to strip names, email addresses and shipping addresses out of every order and customer response. Turn it on when a program needs to see what sold without seeing who bought it — an AI agent running on your own machine, for instance.
Use a key
Send it in the Secret-Key header:
Secret-Key: sk_your_key_here
The full reference, including every endpoint and an OpenAPI file you can feed to a code generator, is at osello.com/api-docs.
Revoke a key
On the API keys tab, click the bin icon next to the key. It stops working immediately, for everything using it, and this cannot be undone. The key stays in your list marked Revoked, so a key you see in a log can still be matched to the one you turned off.
Revoke a key as soon as you suspect it has been copied, shared, or committed to a repository.
Good to know
- Keys do not expire unless you set an expiry when creating one.
- Last used on the list tells you whether a key is still in service. A key that has never been used, or has not been used in months, is usually safe to revoke.
- Treat a key like a password: never paste one into a shared document, a support ticket, or a public repository.