# Create and Manage API Keys

> How to create an API key from your account settings, choose what it can reach, and revoke one you no longer need.

Last updated: Sep 19, 2026 at 11:56PM

An API key lets a program act on your Osello account without signing in as you — a script that syncs your catalog, an integration your developer built, or an AI coding agent working against your data.

## Create a key

1. Open **Manage Account** from the menu under your name, then the **API keys** tab.
2. Click **Create key**.
3. Give it a name you will recognize later, like "Nightly inventory script" or "Local coding agent".
4. Choose what it can reach (see below). Give it the least it needs.
5. Click **Create key**.

The key is shown once, on the screen that appears. Copy it before closing — Osello stores only a fingerprint of it, so nobody, including our support team, can look it up again. If you lose it, revoke the key and create another.

## What a key can reach

Each key is granted one level per kind of data — **No access**, **Read only**, or **Write**:

- **Source data** — products, variants, images, inventory, imports, exports and your store settings.
- **Channel listings data** — listings, field values, channels, offers and submissions.
- **Orders & customer data** — marketplace orders, returns, and the customer details collected to fulfill them.
- **Store settings** — who has access to the store, your subscription and invoices.

The first three build on each other, so each one appears only once the one above it is readable. A key that can't see your products can't see the listings made from them, and a key that can't see your listings can't see the orders they produced. For the same reason, a category can't be set higher than the one it depends on: to write listings, a key needs to write products too.

A key can never do more than the person it belongs to. Remove someone from a store and their keys lose that store with them.

**Redact PII data.** When a key has read-only access to orders, a checkbox appears inside that section to strip names, email addresses and shipping addresses out of every order and customer response. Turn it on when a program needs to see what sold without seeing who bought it — an AI agent running on your own machine, for instance.

## Use a key

Send it in the `Secret-Key` header:

```
Secret-Key: sk_your_key_here
```

The full reference, including every endpoint and an OpenAPI file you can feed to a code generator, is at [osello.com/api-docs](https://osello.com/api-docs).

## Revoke a key

On the **API keys** tab, click the bin icon next to the key. It stops working immediately, for everything using it, and this cannot be undone. The key stays in your list marked **Revoked**, so a key you see in a log can still be matched to the one you turned off.

Revoke a key as soon as you suspect it has been copied, shared, or committed to a repository.

## Good to know

- Keys do not expire unless you set an expiry when creating one.
- **Last used** on the list tells you whether a key is still in service. A key that has never been used, or has not been used in months, is usually safe to revoke.
- Treat a key like a password: never paste one into a shared document, a support ticket, or a public repository.

## Where to go next

- [Using the Osello API](/help/account-settings/using-the-osello-api)
- [Manage users](/help/account-settings/manage-users)