A key is how a website proves it is yours. It lives on Agency Partners → Website & API in your account.
One key per site
Give each key the name of the site it is for. Five may be active at a time, which covers your sites plus a staging copy. Sharing one key between two sites works and is a bad idea: you then cannot tell which site did what, and cannot revoke one without breaking the other.
What a key can and cannot do
| Can | Cannot |
|---|---|
| Read your catalogue and your prices | Take a card or touch your payment methods |
| Check whether a domain is free | See your invoices |
| Create clients and place orders in your space | Change your plan, your details or your other keys |
| Read back the orders it placed | Reach another agency's clients or orders |
A key never sees a card. When automatic payment is on (your Balance page), an order it places is paid from your Agency balance — so the balance is the most a key can ever spend. Turn automatic payment off if you would rather approve each order yourself.
What the page tells you
Each key shows its name, its first characters, the website that last used it, when that was and how many calls it has made. That is enough to recognise a key you no longer want.
Showing and copying a key again
Click Show & copy beside an active key: it appears at the top of the page with a copy button, and disappears again as soon as you leave the page. We keep each key encrypted, and the secret that opens it is kept apart from our database.
Keys created before 5 October 2026 were stored as a one-way fingerprint only. Those cannot be shown again — the page says so beside them. Create a new key, paste it into the site, then delete the old one.
Revoking
Click Revoke beside the key. From that moment anything still using it is refused, and the site that was using it says so on its dashboard.
The row stays on the page, marked revoked, with the usage it had. That is on purpose: after a key has been revoked is exactly when you want to know what it had been doing.
Deleting
Click Delete, then confirm. The key is removed from the page for good and, if it was still active, anything using it is refused at once. Its usage history goes with it — revoke instead if you want to keep that.
Important
Revoke a key whenever you have any doubt about it — a laptop lost, a contractor leaving, a site handed over. Creating a replacement takes seconds and the only thing to do afterwards is paste the new one into that site.
If you lose a key
Click Show & copy beside it. If it is one of the older keys that cannot be shown, create another and delete the old one. Your products, your prices, your clients and your orders are untouched by the change — the key is a credential, not a container.
When you remove the plugin
Uninstalling removes the plugin's settings from WordPress, key included. Revoke that key here as well: nothing should hold a credential that no longer has a use.