API key integrations

API key integrations let server-side vendor systems call the COPE public API for one COPE business. Each key has a mode, a public prefix, a secret shown only once, an active state, and last-used metadata.

Lifecycle

Action	Guidance
Create	Create a named integration in the COPE dashboard and copy the secret immediately.
Store	Store the full token in a server-side secret manager. Do not expose secret keys in browsers or mobile apps.
Rotate	Create a replacement key, deploy it, confirm traffic, then deactivate the previous key.
Deactivate	Deactivated keys stop authenticating within 60 seconds. Activate the key again to restore it.
Delete	Delete keys that are no longer needed after confirming no clients use them. A deleted key stops authenticating within 60 seconds and cannot be restored.

Key format

New keys use the format ck_live_<prefix>_<secret>: a 12-character alphanumeric prefix that identifies the key and is safe to display, and a 48-character lowercase hexadecimal secret that is shown only once. Keys issued earlier in the format cope_sk_live_<key_id>_<secret> keep working unchanged.

Where keys are managed

Create, activate, deactivate, and delete API keys in the COPE dashboard under Settings → API Keys. The full token is shown only once, when the key is created. COPE does not store it and cannot show it again. Keys are managed only in the dashboard. The public API has no key-management endpoints, so an API key cannot create, activate, deactivate, or delete keys.

Access

Choose the access when you create a key. It cannot be changed later: create a new key instead.

Access	What the key can do
Full access	Read and change, through the public API, what the person who created it can in that business.
Read only	Read, through the public API, what the person who created it can, and change nothing. Every write answers `403 insufficient_scope`. Use it for reporting, exports and AI assistants.

Either way, a key never reaches more than its creator can. If their role in the business narrows, or they leave it, the key narrows or stops working with them.

​API key integrations

​Lifecycle

​Key format

​Where keys are managed

​Access

API key integrations

Lifecycle

Key format

Where keys are managed

Access