Make an API key

An API key lets your own software, such as a script or an app you've built, reach one business through the GrowLocal API. It can reach only the areas you choose when you make it, and never more than you can do yourself.

Where keys live

Open the business in GrowLocal, go to Settings, then Developers & AI → API. The page lists the business's keys and has New key at the top.

A key belongs to the business it was made in. To reach another business, make a key there.

Everyone on the team who can open this page can make keys. You see and revoke your own keys; the business's administrators see and can revoke every key.

Make a key

  1. Press New key.
  2. Give it a Name that says what will use it, so you can recognise it in the list later.
  3. For each area, choose None, Read or Act. Read lets the key look; Act lets it make changes too. Only the areas you can reach yourself are offered, and where you can only view, Act isn't available ("You can only read here"). Choose at least one area.
  4. Choose when it Expires after: 7, 30 or 90 days. 90 days is the default and the longest a key can live.
  5. Press Create key.

If an area holds nothing a key can reach yet, GrowLocal says so beside that area and makes no key.

Copy it once

The next screen, Copy your key, shows the key one time: "You won't see this key again." Copy it straight into wherever your software keeps its secrets. Keys start with gl_.

Treat a key like a password. Never put it in a web page, a public repository or a message. If a key is lost or might have been seen, revoke it and make a new one.

What a key can reach

A key's reach is fixed when you make it: the areas and levels you picked. Anything added to an area later isn't added to an existing key; make a new key for it.

A key also never outgrows its maker. Every call is checked against what you can do at that moment, so if your own access is narrowed, the key's is too, and Act only changes things where you still may.

The key list

Each key's row shows its name, its first few characters (gl_…), what it can reach (for example "Business: Act · Operations: Read"), when it was last used and when it expires. A key that has stopped working shows Revoked, Expired or Paused instead.

Revoke a key

Press Revoke on the key's row and confirm with Revoke key. Anything using it stops working right away, and a revoked key can't be turned back on.

Next

Quickstart makes your first call with the key; Authentication shows how every request sends it.