API key integrations

API key integrations let server-side vendor systems call the COPE public API for one COPE business. Each key has a mode, a public key ID, a secret shown only once, an active state, and last-used metadata.

Lifecycle

Action	Guidance
Create	Create a named integration in the COPE dashboard and copy the secret immediately.
Store	Store the full token in a server-side secret manager. Do not expose secret keys in browsers or mobile apps.
Rotate	Create a replacement key, deploy it, confirm traffic, then deactivate the previous key.
Deactivate	Deactivated keys stop authenticating and return `401 invalid_token`.
Delete	Delete keys that are no longer needed after confirming no clients use them.

Key format

COPE secret keys use the format cope_sk_<mode>_<key_id>_<secret>. The key ID is safe to display for identification, but the secret tail is shown only once.

Where keys are managed

Create, rotate, activate, deactivate, and delete API keys in the COPE dashboard under Settings → API Keys. The secret is shown only once, at creation and after a rotation.

​API key integrations

​Lifecycle

​Key format

​Where keys are managed

API key integrations

Lifecycle

Key format

Where keys are managed