> ## Documentation Index
> Fetch the complete documentation index at: https://docs.florists.digital/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create partner API keys for your shop, choose what each key can access, and rotate or revoke them at any time.

**API keys** let an outside system, such as a logistics partner or a developer working for you, read data from your shop through the [Partner API](/api-reference/overview). Each key belongs to your shop, carries only the permissions you choose, and can be revoked at any time.

<Info>
  **This page covers features gated by Admin-tier permissions** — typically Settings access. Admins have these by default; your administrator can adjust who has them in [Settings > Team](/settings/team).
</Info>

## Before you start

API keys are part of the **API Access** add-on, available on Enterprise plans and to select partners and integrators. If it isn't on your plan, the API Keys screen still lists any existing keys but you can't create, rotate, or revoke them. Contact us to discuss adding API access to your plan.

## Creating a key

Go to **Settings** > **API Keys** and click **Create API key**.

<Steps>
  <Step title="Name the key">
    Give the key a recognisable name, such as "Acme Logistics integration", so you always know which system it belongs to. Use one key per integration.
  </Step>

  <Step title="Choose scopes">
    Scopes control what the key can do: read orders, read customers, include personal contact details, create customers, read products, or manage webhook subscriptions. Grant only what the integration actually needs. See [Authentication](/api-reference/authentication) for what each scope covers.
  </Step>

  <Step title="Set an expiry">
    Every key must expire. The expiry is set to 90 days ahead by default, and you can choose any date up to 365 days from today.
  </Step>

  <Step title="Copy the token">
    When you click **Create API key**, the new token appears once at the top of the API Keys screen. Copy it straight away and pass it to your integration partner through a secure channel.
  </Step>
</Steps>

<Warning>
  The token is shown only once, immediately after the key is created. If you leave the screen without copying it, it cannot be recovered. Rotate the key to get a new token instead.
</Warning>

## Managing your keys

The API Keys screen lists every key with its scopes, when it was last used, when it expires, and its status: **Active**, **Expired**, or **Revoked**.

* **Rotate** issues a new token for the key and shows it once, just like creating a key. The old token stops working immediately, so coordinate with your integration partner before rotating. Rotation also resets the expiry to 90 days from today.
* **Revoke** cuts the key's access immediately and cannot be undone. Use it when an integration ends or you suspect a token has leaked. Create a new key if you need access again later.

Every key created, rotated, or revoked is recorded in your [Audit Logs](/settings/audit-logs).

## Webhooks are managed by your partner

Webhook subscriptions are not set up on this screen. Your integration partner creates and manages them through the API itself, using a key that carries the webhook scope. If a partner asks for webhooks, all you need to do is include that scope when you create their key. See [Webhooks](/api-reference/webhooks) for what your partner will set up.