Skip to main content

Getting Started — Creating an API Key

Updated

API keys are managed inside the web app. Any user with the Admin, Manager, Company Admin or Company Manager role can open the page:

  1. Sign in to PSS.
  2. Go to Settings → API Keys.
  3. Click Generate New Key. In the Generate New API Key dialog, enter a Key Name that describes the integration (for example, “Reporting Dashboard”) and click Generate.
  4. The API Key Generated dialog shows the full key once. Use the copy button to copy it, store it securely, then click I’ve copied it.

Note: Each key is displayed exactly once, at creation. PSS stores only a hash of the key, so there is no way to view an existing key again. If a key is lost, revoke it and generate a new one. In the key list, only the first 8 characters are shown, followed by a mask.

Key facts:

  • Keys are 64 random hex characters.
  • A company can hold up to 3 keys at a time (revoked keys do not count). Use one key per integration so each can be revoked independently. When you are at the limit, the Generate New Key button is disabled and the page tells you to revoke an existing key first.
  • The API Keys page also shows a usage bar — X of 100,000 API calls/month — and, once you go over, an orange banner: You’ve exceeded your monthly request limit — overage charges apply.
  • The API Keys tab appears in Settings only while the API Access module is offered by PSS; a company without an active API subscription still sees the tab, but in its locked state.

Managing keys

Each key in the table shows its Name, masked Key, Created at date, Status (Active, Disabled or Suspended) and Last Used date. The row menu (⋯) offers:

  • Disable Key — temporarily blocks the key (requests return 401) without deleting it. The status badge turns to Disabled.
  • Enable Key — re-activates a disabled key.
  • Revoke — permanently invalidates the key. The Revoke API Key dialog warns that any application using the key loses access and the action cannot be undone; click Delete to confirm. Revoked keys disappear from the list and free up a slot.

Note: Suspended is set by PSS, not by you — it appears when an overage invoice is overdue (see 20.2). You cannot enable a suspended key; paying the invoice restores it.

Sending the key

Pass the key on every request in the x-api-key request header. The header value is the raw 64-character key with no prefix (no Bearer, no quotes). Requests with a missing, invalid, disabled, suspended, or revoked key return 401, as do requests from a company whose API subscription has lapsed.