Create and manage API keys

Who can manage keys

Workspace owners and admins can create and revoke keys, because a key spends the workspace’s credits. Other members see that keys are managed by an owner or an admin.

Keys are created only in the app, under Settings → Developers. No endpoint creates keys, so a leaked key can never be used to make more.

Create a key

1. Choose the kind

   Secret key for your servers, or Publishable key for the website visualizer. See Secret and publishable keys.

2. Name it

   Up to 100 characters. Name it for what will use it, such as “PIM sync” or “Website visualizer”, so you know what stops if you revoke it.

3. List its websites (publishable keys only)

   One per line, such as https://www.example.com. See Allowed websites.

4. Copy it now

   The key is shown once, when it is created. Copy it straight into your secret manager or environment. If you lose it, revoke it and create another: it cannot be shown again, by us or by anyone.

Read the key list

The Developers page lists every key the workspace has created:

A key cannot be edited once created. To change its name or its websites, create a new key and revoke the old one.

Rotate a key

Replace a key without stopping anything that uses it:

1. Create the new key

   Give it the same kind and websites, and a name that says it is new, such as “PIM sync (2026-10)”.

2. Deploy it

   Put the new key wherever the old one is used, and check each system works, for example with Retrieve your account.

3. Revoke the old key

   Once the old key’s “Last used” time stops moving, revoke it.

Revoke a key

Choose Revoke beside the key. Anything using it stops working at once, and this cannot be undone. A revoked key stays in the list, marked with the date, so you can see what it was.

Allowed websites

A publishable key works only on the websites listed on it. Each entry is a website’s address, with no path:

• https:// only. Plain http:// is accepted for localhost, so you can test on your own computer.
• Exact matches only. https://example.com does not cover https://www.example.com or https://shop.example.com: list each one you use.
• No paths, queries or fragments: https://www.example.com/sofas is refused; list https://www.example.com.
• Up to 20 websites on one key.

On any other website the visualizer refuses to open. That is what makes a publishable key safe to put in your page’s HTML.

If a key leaks

1. Revoke it

   Revoke the key in Settings straight away. It stops working at once, so nothing more can be charged with it.

2. Replace it

   Create a new key and deploy it to the systems that used the old one.

3. Check what it did

   Look at recent renders in your gallery, which marks those made through the API, and cancel any you did not ask for that are still queued, for their credits back. See Cancel a render.

4. Tell us

   Email admin@skipshoot.com with the key’s name and when it leaked, never the key itself, and we will help you review what was charged.