Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configure an API Key

API Keys

API keys are the credentials your backend uses to talk to Engage and the WalletTwo platform on behalf of your company. Every request your servers make — reading balances, triggering workflows, issuing tokens, querying events — is authenticated with a key you issue from this page.

You'll find it in the sidebar under Dashboard → API Keys. The page is gated: if it doesn't appear, your role doesn't include API key access — ask an admin to grant it.

Create an API key

  1. Click Create API Key at the top right of the page.

  2. In the Create API Key modal, fill in the Name field — this is how you'll recognize the key later, so use something descriptive like backend-prod, webhook-ingest, or analytics-read.

  3. Click Create.

On success:

  • A "API Key created successfully" toast appears.

  • The new key shows up at the top of the table.

  • The Secret column displays the key value inline, next to a Copy button.

The Name is required. Submitting an empty name shows a "Name is required" error; cancelling the modal discards the draft.

You cannot edit a key after creation. If you need a different name, create a new key and delete the old one.

Copy the secret immediately

The full secret is only displayed at creation time (and for the current session). Once you reload the page or navigate away, the Secret column will show "Hidden" instead of the value and there is no way to reveal it again.

What to do:

  1. As soon as the key appears in the table, click Copy. The button changes to "Copied!" for three seconds as confirmation.

  2. Paste the secret into your secrets manager, CI environment variables, or backend configuration.

  3. Treat it like a password — never commit it to source control, never paste it into chats or tickets, never send it over email.

If you lose a secret before copying it, your only option is to delete the key and create a new one.

Delete an API key

Deleting a key is the way to revoke programmatic access for whatever system was using it.

  1. Find the key's row in the table and click the red Delete button in the Actions column.

  2. A confirmation modal appears titled "Delete API Key" with the warning "Are you sure you want to delete this API Key? This action cannot be undone."

  3. Confirm to proceed, or close the modal to cancel.

On success:

  • The row disappears from the table.

  • A "API Key deleted successfully" toast appears.

  • Any server using that key will start receiving authentication errors on its next request — rotate in a replacement key first if you can't tolerate downtime.

Rotating a key safely

There is no in-place rotate action — rotation is a two-step process:

  1. Create a new key (e.g. backend-prod-2025-04).

  2. Copy the new secret and deploy it to the system that needs it.

  3. Once the new key is live and verified, delete the old key.

Doing it in this order avoids an outage window between revocation and re-deploy.

Security recommendations

  • One key per integration. Separate keys for separate services (backend, CI, analytics) make rotation and revocation surgical rather than disruptive.

  • Name keys for their owner. Encode the environment and service in the name — ingest-staging, analytics-prod — so the Created At column plus the name tells you everything at a glance.

  • Rotate on a schedule and immediately after anyone with access to the secret leaves the team.

  • Store secrets in a vault (1Password, AWS Secrets Manager, Vercel/Netlify env vars, etc.) — never in repo files, shared drives, or chat.

  • Revoke on compromise. If you suspect a key has leaked, delete it from this page first, then investigate.

Troubleshooting

I just created a key and the Secret column shows "Hidden". You reloaded the page or navigated away before copying. Delete the key and create a new one, then copy the secret immediately.

The Copy button didn't confirm with "Copied!". Your browser blocked clipboard access. You'll see a "Failed to copy secret" error. Grant clipboard permissions or select the secret text manually.

I don't see the API Keys page in the sidebar. Your role doesn't include API key management for this company. Ask an administrator to adjust your role from Members.

My server is getting authentication errors after a deploy. Check whether the key was recently deleted on this page. If so, create a new one and update the environment variable in your deploy.

PreviousExamples
NextBalance

Last updated