> ## Documentation Index > Fetch the complete documentation index at: https://vexioncards.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # API keys > Create keys to connect your own tools to the VEXiON cards API, and control exactly what each one can do. The **Developer** tab under [Settings](https://vexioncards.mintlify.site/knowledge-base/settings-overview.md) is where you connect your own software to VEXiON cards. It has up to three parts: **API keys** (this page), [Webhooks](https://vexioncards.mintlify.site/knowledge-base/developer-webhooks.md) and [AI assistants](https://vexioncards.mintlify.site/knowledge-base/developer-ai-assistants.md). The AI assistants part appears only when it is available to your account. The Developer tab is available to **admins**. API keys and webhooks are available on every plan except **VEXiON cards ONE**. On ONE the Developer tab is still there and offers you the upgrade instead of the tools. An **API key** is a secret password for a program. Where you sign in to the dashboard with your email, your scripts, your website, or a partner's system sign in to the [VEXiON cards API](https://vexioncards.mintlify.site/api-reference/introduction.md) with a key. Anything the API can do, a key can do, which is why each key only carries the permissions you give it. > [!NOTE] > > Keys created here start with `vxn_sk_`. They are production keys and work against your live loyalty data straight away. A separate sandbox is provisioned on request: contact us and we create a sandbox organization with its own `vxn_test_sk_` key, used against `https://migration.api.vexioncards.one`. We send you the sandbox address together with the test key. Treat every key from this tab as production. ![The API keys tab: a table of keys with their label, masked key, scopes, status, and created date, and a Create key button.](https://mintcdn.com/vexioncards/1PqVTBUmqdcXLvUP/images/settings-developer-api-keys.png?fit=max\&auto=format\&n=1PqVTBUmqdcXLvUP\&q=85\&s=05434eb829d245710984097f83cb0458) Settings → Developer → API keys ## Creating a key **1. Open the Developer tab** Go to **Settings → Developer** and stay on the **API keys** tab. **2. Click Create key** Give the key a **Label**, a name only you see, so you can tell your keys apart later (for example *Production server*, *Zapier*, or *Accountant export*). Use one key per system, never share a single key across several. A key needs a label and at least one scope. **3. Choose its scopes** Tick the permissions this key needs, and nothing more (see [Scopes](#scopes) below). **4. Agree to the API terms** Tick the box confirming that, by creating a key, you agree to **Articles 7 and 8** of the Terms of Service (Third Party Platforms and Public API) and to **Annex 1 (DPA)** for the data processed through the API. The link next to it opens the published text. **Create key** stays greyed out until this is ticked. **5. Copy the key, once** Click **Create key**. The full key is shown **one time only**. Copy it and paste it into your system's settings right away. > [!WARNING] > > **The key is shown once and can never be seen again.** For your security we only store a scrambled version, so we cannot recover or re-display it. If you lose it, revoke that key and create a new one. ## Scopes **Scopes** are the individual permissions a key carries. They come in two kinds: * **Read access** (`...:read`), the key can *view* that data. * **Write access** (`...:write` / `...:send`), the key can *change* or *create* that data. Flip **All permissions** on to grant everything at once (a master key), or tick just the boxes you need. The golden rule is **least privilege**: a key that only exports customers should hold `customers:read` and nothing else, so a leaked key can do as little damage as possible. ![The Create API key dialog: a Label field, an All permissions switch, and the read and write scopes as grouped checkboxes.](https://mintcdn.com/vexioncards/1PqVTBUmqdcXLvUP/images/settings-developer-create-key.png?fit=max\&auto=format\&n=1PqVTBUmqdcXLvUP\&q=85\&s=4583d036077f7043cc6200cb0fae1bbc) Choosing scopes when creating a key | Scope | What it allows | | - | - | | `customers:read` | View customer profiles and balances | | `customers:write` | Create, update, or delete customers | | `cards:read` | View card details and balances | | `cards:write` | Create, update, or delete cards | | `transactions:read` | View transaction and reward history | | `transactions:write` | Record new transactions | | `products:read` | View products and their prices | | `products:write` | Create or update products (no delete, retire a product with `is_active=false`) | | `custom_fields:read` | View custom field definitions | | `custom_fields:write` | Create, update, or delete custom fields | | `locations:read` | View store locations | | `locations:write` | Update store locations (no create or delete) | | `team_members:read` | View team member details | | `team_members:write` | Invite and update team members (no remove) | | `notifications:read` | View sent notifications and their delivery status | | `notifications:send` | Send push notifications to customers | | `webhooks:read` | View webhook endpoints and delivery attempts | | `webhooks:manage` | Create, update, and manage webhook endpoints | | `organization:read` | View organization details, plan, and invoices | > [!NOTE] > > A key can only ever do what its scopes allow. If a request needs a permission the key does not hold, the API refuses it, so granting less is always safe. ## Using a key Send the key in the `Authorization` header on every request, as a **Bearer** token: ```bash theme={null} curl https://api.vexioncards.one/v1/customers \ -H "Authorization: Bearer YOUR_API_KEY" ``` That is all it takes to authenticate. From there the [API Reference](https://vexioncards.mintlify.site/api-reference/introduction.md) covers everything you can do, start with the [Quickstart](https://vexioncards.mintlify.site/api-reference/quickstart.md), then see [Pagination](https://vexioncards.mintlify.site/api-reference/pagination.md), [Rate limits](https://vexioncards.mintlify.site/api-reference/rate-limits.md), [Idempotency](https://vexioncards.mintlify.site/api-reference/idempotency.md), and [Errors](https://vexioncards.mintlify.site/api-reference/errors.md). ## Managing your keys Each key in the table shows its **label**, a masked preview of the key, its **scopes**, its **status**, and when it was **created**. | Status | Meaning | | - | - | | **Active** | Working normally. | | **Paused** | Temporarily switched off. Any request using it is refused. | | **Revoked** | Switched off permanently. Any request using it is now refused. | ### Revoking a key Open the **⋯** menu on a key and choose **Revoke** when a key is no longer used, may have leaked, or belonged to a system you have retired. > [!WARNING] > > Revoking **cannot be undone**, and every request using that key stops working within about 60 seconds. If a system still needs access, create a fresh key for it first, then revoke the old one. ## Next steps > [card] [Set up webhooks](https://vexioncards.mintlify.site/knowledge-base/developer-webhooks.md) > > Get a signed message the moment something happens, instead of polling for changes. > [card] [API Reference](https://vexioncards.mintlify.site/api-reference/introduction.md) > > Full documentation of every endpoint, field, and response. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.