API Keys

Secret keys authenticate your applications with Commerce. Each key contains an opaque bearer token that identifies your app and authorizes API access. Generate new keys when rotating credentials or giving another server-side integration its own credential.

The Key object

Properties

Name
id
Type
string
Description
Unique identifier for the key.
Name
issued_at
Type
timestamp
Description
ISO 8601 timestamp when this key was generated.
Name
label
Type
string
Description
Optional label supplied when the key was generated.
Name
token
Type
string
Description
Opaque bearer token for authentication. Do not parse it, commit it to source control, expose it in client-side code, or log it.
Name
token_type
Type
string
Description
Always "bearer". Indicates this token should be used in Authorization headers as Bearer $COMMERCE_API_KEY.

Generate a key

Generate a new secret key for your application. The API creates a cryptographically secure token tied to your app and returns it in the response. This is your only opportunity to access the full token value—store it immediately in a secure location like environment variables or a secrets manager.

Generating a new key does not invalidate existing keys. This lets you rotate credentials safely: generate the new key, deploy it to your services, verify everything works, then revoke the old key through the supported product surface.

Treat the token as opaque. Its characters and prefix do not select an environment or describe how requests will behave.

Request attributes

Name
label
Type
string
Description
Optional label for identifying the key. Surrounding whitespace is trimmed; an empty value is omitted from the response.

Request

POST

/keys/generate

curl https://api.zebo.dev/keys/generate \
  -H "Authorization: Bearer $COMMERCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"checkout-api"}'

{
  "key": {
    "id": "key_<KEY_ID>",
    "issued_at": "2025-02-15T14:35:00Z",
    "label": "checkout-api",
    "token": "<SECRET_KEY_TOKEN>",
    "token_type": "bearer"
  }
}