Skip to main content

Integration Settings | Viewing and Rotating API Keys

Subotiz API keys provide the credentials required to connect a merchant's website, app, or other business system to Subotiz. Merchants can view the Standard key and Access No. in Integration Settings and rotate API keys when existing credentials need to be replaced, helping maintain secure API authentication and system integration.
 

Accessing API Keys

  1. Open Integration Settings: Log in to the Subotiz admin and go to Developer > Integration Settings.
 
  1. Open API Keys: Click the API Keys tab to view the Standard key and Basic information for the current account.
 

Standard Key Details

The Standard key is used for API integration and provides full API access.
If a Standard key is available for the account, the following information is displayed:
  • Name: The name assigned to the Standard key.
  • ID: The unique identifier for the Standard key.
  • Token: The credential used to access the Subotiz API.
  • Status: The current status of the Standard key, such as Active.
  • Expiration date: The expiration date of the Standard key.
Note: The Standard key is a sensitive credential. Store it securely and never expose it publicly. Standard key availability varies by account. Refer to the API Keys tab for the information available to the current account.
 

Access No.

The Access No. is displayed in the Basic information section and is used for system integration. Refer to the applicable API documentation when using the Access No. for API integration.
 

Rotating API Keys

API key rotation generates a new key and allows merchants to set when the current key expires. The new key becomes available immediately after rotation, while the current key can remain valid for a selected period to allow time to update connected business systems.
  1. Open the key action menu: In the Standard key section, locate the key to rotate and click ··· > Rotate Key.
 
  1. Confirm the key details: In the Rotate API Key dialog, confirm the ID and token of the key being rotated.
 
  1. Select an expiration period: Click Expiry and select how long the current key remains valid:
    • Now
    • Within 1 hour
    • Within 24 hours
    • Within 3 days
    • Within 7 days
 
  1. Confirm the rotation: Click Rotate API Key to generate a new key. The current key will expire based on the selected period.
Note:
  • New key availability: A new key becomes available immediately after rotation.
  • Select Now: The current key expires 3 minutes after rotation.
  • Use delayed expiration: Both the new and current keys remain valid during the selected period. After the current key expires, it can no longer be used.
  • Manage webhook key transition: Webhook endpoints continue using the current key until it expires, then automatically switch to the new key.
 

Best Practices

  • Rotate keys as needed: Rotate API keys based on the organization's security policies and credential management requirements.
  • Allow time for migration: If connected business systems still use the current key, select an appropriate expiration period and update them with the new key before the current key expires.
  • Protect tokens: Never expose key tokens in web pages, front-end code, public documentation, screenshots, or messaging tools.
  • Store keys securely: Store keys in a secure server environment, environment variables, or a dedicated secrets management tool.
 
Subotiz API keys provide the credentials required for API integration and support secure credential updates through key rotation. Setting an appropriate expiration period and migrating connected systems to the new key before the current key expires helps maintain uninterrupted API access and account security.