Skip to main content

API keys

An API key lets an external system — a reporting tool, an ERP, a partner integration — call the Woltti platform API without a person signing in. Keys are managed on the API keys page (CompanyAdmin only), and every request made with a key is attributed to the key by name in the audit trail.

The license​

Public API access is a licensed feature. The page is active only while your organisation holds a FEATURE-PUBLIC-API license that is active and paid — the banner at the top shows the license number and its paid-through date. If the license lapses, existing keys stop working (integrations receive a distinct "license inactive" error, not a broken-key error) and resume when the license is reinstated. Contact Woltti to add the license.

Creating a key​

  1. Click Create API key and name it after the integration it serves ("ERP sync"), not the person creating it — the name is what the audit trail shows as the actor.
  2. Pick the role — the key's privilege ceiling. Accountant (default) covers read-heavy reporting integrations; CompanyAdmin is for integrations that manage the platform.
  3. Grant scopes: per product area, choose none / read / read & write. Grant only what the integration needs — Select all (read) is a shortcut for pure reporting keys. Scopes use the same area names the API reference shows for each endpoint.
  4. After creation the key is shown exactly once. Copy it into your secret manager immediately; the platform stores only a fingerprint and can never display it again.

The integration sends the key in the API-KEY request header.

Managing keys​

  • The list shows each key's prefix (for recognizing it in configs), role, scopes, creator, last used time and status. A key that hasn't been used in months is a candidate for revocation.
  • Edit changes the name and scopes; scope changes take effect within about a minute.
  • Regenerate issues a new secret — the old one stops working immediately. Use it if a key may have leaked, or after switching a key created before gateway integration.
  • Revoke disables the key permanently (type the key's name to confirm). Create a new key instead of reusing revoked ones.

Every create, change, regeneration and revocation is recorded in the audit panel at the bottom of the page, and the actions an integration performs appear throughout the platform's history with the key's name as the actor.